sync-release-branch: Run from master against selected release#7101
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
One security-category finding was confirmed: the new release_branch workflow input is validated only against the literal string "master", but the value is used directly in git push origin "FETCH_HEAD:$RELEASE_BRANCH". A dispatcher with repository write access can bypass the guard using a full refname (e.g. refs/heads/master) and push the synced commit to an unintended branch. Recommend adding a strict pattern match (e.g. ^[0-9]+\.[x0-9]+$) in the Validate step.
The workflow previously inferred its target from the dispatch ref, requiring operators to always sync the release branch with the workflow/scripts on master. Accept the release branch as an input, keep the dispatched master checkout as the script source, and merge in a detached worktree at the selected release revision. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Without it GitHub rejects the push: ``` refusing to allow a GitHub App to create or update workflow `.github/workflows/build.yml` without `workflows` permission ``` Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The workflow refactor is logically correct: the branch check inversion, worktree-based script isolation, and inputs.release_branch threading all look sound. One minor validation note below.
4 participants
sync-release-branch: Run from master against selected release
The workflow previously inferred its target from the dispatch ref, requiring operators to always sync the release branch with the workflow/scripts on master.
Accept the release branch as an input, keep the dispatched master checkout as the script source, and merge in a detached worktree at the selected release revision.
gha/sync-release-branch: Add workflows write permission
See https://docker.slack.com/archives/C08453R6RV4/p1783680790750159
Without it GitHub rejects the push: