From a9e0abd9bd3286dda82659750409a2a74a50c6cf Mon Sep 17 00:00:00 2001 From: ctorres100 Date: Thu, 24 Sep 2026 11:53:20 -0400 Subject: [PATCH] Restrict /apply-optimize workflow to trusted authors The skill-optimize-apply workflow triggers on issue_comment and runs with contents:write and pull-requests:write. The only condition was that the comment is on a PR and contains "/apply-optimize", so any GitHub user could post that comment and invoke a write-capable job that checks out the repo and runs a third-party action in apply mode. Add an author_association gate so only OWNER, MEMBER, or COLLABORATOR can trigger the job, closing the privilege-escalation path. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/skill-optimize-apply.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/skill-optimize-apply.yml b/.github/workflows/skill-optimize-apply.yml index 1551909..622530f 100644 --- a/.github/workflows/skill-optimize-apply.yml +++ b/.github/workflows/skill-optimize-apply.yml @@ -5,9 +5,13 @@ on: jobs: apply: + # Only trusted users may trigger this write-capable job. Without an + # author-association gate, any GitHub user could post "/apply-optimize" + # on a PR and run a job that holds contents:write / pull-requests:write. if: > github.event.issue.pull_request && - contains(github.event.comment.body, '/apply-optimize') + contains(github.event.comment.body, '/apply-optimize') && + contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) runs-on: ubuntu-latest permissions: pull-requests: write