chore: add repository synchronization gates - #4859
Conversation
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
WalkthroughAdds one workflow that dispatches public repository SHA updates to a private monorepo. Adds another workflow that blocks reserved RepoOps trailers in pull requests and polls repository synchronization during merge groups. Merge Risk: 🟡 Moderate · up to The PR adds repository synchronization dispatch and merge-queue gating, but the current behavior can run the gate before synchronization is configured, broaden credential scope when repository configuration is empty, and delay merge processing if an operation hangs. These bounded availability and security risks require fixes or explicit owner acceptance before merge. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Team
Run ID: 7a152ca9-b68e-40ed-a595-a774409c29f0
📒 Files selected for processing (2)
.github/workflows/dispatch-repo-ops-sync.yml.github/workflows/repo-ops-sync-gate.yml
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: code-quality / code-quality
- GitHub Check: Analyze (javascript-typescript)
⚠️ CI failures not shown inline (1)
GitHub Check: zizmor: 2 new alerts including 2 errors
Conclusion: failure
### New alerts in code changed by this pull request
* 2 errors
See annotations below for details.
[View all branch alerts](/triggerdotdev/trigger.dev/security/code-scanning?query=pr%3A4859+tool%3Azizmor+is%3Aopen).
🧰 Additional context used
🪛 GitHub Check: zizmor
.github/workflows/dispatch-repo-ops-sync.yml
[failure] 26-26:
dangerous use of GitHub App tokens: token granted access to all repositories for this owner's app installation
.github/workflows/repo-ops-sync-gate.yml
[failure] 44-44:
dangerous use of GitHub App tokens: token granted access to all repositories for this owner's app installation
🔇 Additional comments (2)
.github/workflows/dispatch-repo-ops-sync.yml (2)
26-27: Restrict the App token to the target repository.This repeats the existing review finding. With
owner: triggerdotdevand norepositoriesinput,actions/create-github-app-token@v3.2.0scopes the token to every repository in that owner's installation.permission-contents: writemakes that scope writable. (github.com)Add a single-repository
repositoriesallowlist before enabling the workflow. Then verify that the generated token is limited toMONO_REPOSITORY.Proposed scope fix
owner: triggerdotdev + repositories: ${{ secrets.REPO_OPS_MONO_REPOSITORY }} permission-contents: writeSources: MCP tools, Linters/SAST tools
1-25: LGTM!Also applies to: 29-41
| contents: read | ||
|
|
||
| jobs: | ||
| gate: |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Add an explicit RepoOps activation guard.
The job runs for every pull request and merge group. It does not wait for repository configuration. On a merge-group event without the App variables and secret, Create read-only Dispatcher App token fails and blocks the queue. Add a job-level condition that requires an explicit enable variable.
Proposed fix
jobs:
gate:
+ if: vars.REPO_OPS_SYNC_ENABLED == 'true'
runs-on: ubuntu-latest📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| gate: | |
| gate: | |
| if: vars.REPO_OPS_SYNC_ENABLED == 'true' |
| git clone --filter=blob:none --no-tags \ | ||
| "https://x-access-token:${APP_TOKEN}@github.com/${MONO_REPOSITORY}.git" mono | ||
|
|
||
| for _ in $(seq 1 60); do |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Bound each polling operation.
The loop limit only applies after git fetch and plan-repo-ops-outbound.sh return. If either command hangs, the merge-group gate does not reach Line 84 and remains running until the workflow job limit. Add a job timeout and command-level deadlines.
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Team
Run ID: 2ceba81b-df58-4b76-95a8-6104df065319
📒 Files selected for processing (2)
.github/workflows/dispatch-repo-ops-sync.yml.github/workflows/repo-ops-sync-gate.yml
Included review availability: Your plan provides up to 10 included reviews per hour; 7 remain after this review.
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: code-quality / code-quality
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (2)
.github/workflows/repo-ops-sync-gate.yml (2)
11-11: Keep the gate inactive until synchronization is enabled.The
gatejob has no job-levelif. It runs on pull request and merge group events whenREPO_OPS_SYNC_ENABLEDis not'true'. Add the same activation guard used bydispatch.
66-74: Bound each merge-group operation.The 60-iteration limit applies only after
git fetchandplan-repo-ops-outbound.shreturn. A hung network call or script can keep the merge-group job running beyond the intended polling window. Add a job timeout and command-level deadlines.
| app-id: ${{ vars.REPO_OPS_DISPATCHER_APP_ID }} | ||
| private-key: ${{ secrets.REPO_OPS_DISPATCHER_APP_PRIVATE_KEY }} | ||
| owner: triggerdotdev | ||
| repositories: ${{ secrets.REPO_OPS_MONO_REPOSITORY }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
printf '%s\n' '--- applicable repository conventions ---'
find /tmp/coderabbit-repo-knowledge/triggerdotdev-trigger-dev-0bdd0019 -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- workflow excerpts ---'
for f in .github/workflows/dispatch-repo-ops-sync.yml .github/workflows/repo-ops-sync-gate.yml; do
echo "### $f"
cat -n "$f" | sed -n '1,90p'
doneRepository: triggerdotdev/trigger.dev
Length of output: 12230
🌐 Web query:
actions/create-github-app-token v3.2.0 README owner repositories empty input all repositories
💡 Result:
In the actions/create-github-app-token v3.2.0 action, the behavior when the repositories input is empty depends on the state of the owner input [1][2]: 1. If owner is provided (explicitly set) and repositories is empty, the resulting token is scoped to all repositories within the GitHub App installation of that owner [1][3]. 2. If both owner and repositories are empty (unset), the token is scoped only to the current repository where the workflow is running [1][2]. The documentation explicitly notes this distinction: "If owner is set and repositories is empty, access will be scoped to all repositories in the provided repository owner's installation. If owner and repositories are empty, access will be scoped to only the current repository" [1][4]. Note that some users have found the documentation's phrasing regarding what constitutes a "set" owner to be slightly ambiguous, but the functional behavior is as described above [5].
Citations:
- 1: https://github.com/actions/create-github-app-token
- 2: https://github.com/actions/create-github-app-token/blob/main/README.md
- 3: https://github.com/marketplace/actions/create-github-app-token
- 4: https://github.com/actions/create-github-app-token/blob/34c66235f6ccc38eb01b7aed860890bdf40db33c/README.md
- 5: GitHub issue 377 in actions/create-github-app-token (link omitted to avoid creating a cross-reference)
Security Misconfiguration (CWE-250)
Reachability: Internal · Exploitability: Difficult
Validate REPO_OPS_MONO_REPOSITORY before creating either App token.
When the secret is empty, owner: triggerdotdev with an empty repositories input scopes the token to all repositories in that installation. Validate the secret before token creation in both workflows.
.github/workflows/dispatch-repo-ops-sync.yml#L27-L27: write-capable token..github/workflows/repo-ops-sync-gate.yml#L45-L45: read-only token.
📍 Affects 2 files
.github/workflows/dispatch-repo-ops-sync.yml#L27-L27(this comment).github/workflows/repo-ops-sync-gate.yml#L45-L45
Source: MCP tools
2 participants
Summary
Adds disabled repository synchronization workflows and guards merge-queue entries against unsynchronized changes. The workflows remain inactive until the repository configuration is explicitly enabled.