Refactor CodeRabbit approval handler to use external labeller token f…#70
Refactor CodeRabbit approval handler to use external labeller token f…#70kpj2006 wants to merge 1 commit intoAOSSIE-Org:mainfrom
Conversation
…or GitHub actions
WalkthroughThis PR modifies the GitHub workflow authentication mechanism by replacing Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Tip Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/coderabbit-approval.yml (2)
114-118: 🧹 Nitpick | 🔵 TrivialSummary step doesn't need the elevated token.
This step only writes to
console.log— it makes no GitHub API calls. Using the PAT here unnecessarily widens the attack surface. Consider keepingsecrets.GITHUB_TOKEN(or omittinggithub-tokenentirely) for this step.Proposed fix
- name: Summary if: steps.check-approval.outputs.is_coderabbit_approved == 'true' uses: actions/github-script@v7 with: - github-token: ${{ secrets.EXTERNAL_LABELLER_TOKEN || secrets.GITHUB_TOKEN }} + github-token: ${{ secrets.GITHUB_TOKEN }} script: |🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/coderabbit-approval.yml around lines 114 - 118, The "Summary" workflow step currently passes an elevated token via the github-token input to actions/github-script; remove the unnecessary elevated PAT by either deleting the github-token line or changing it to use the default secrets.GITHUB_TOKEN (i.e., stop passing secrets.EXTERNAL_LABELLER_TOKEN || secrets.GITHUB_TOKEN), so the Summary step (which only console.logs) runs without the elevated token.
7-10:⚠️ Potential issue | 🟠 MajorPAT bypasses the workflow's
permissionsblock.The
permissionsdeclaration (lines 7–10) only constrains the auto-generatedGITHUB_TOKEN. WhenEXTERNAL_LABELLER_TOKENis a PAT, it carries its own scopes and ignores this block entirely, so the principle-of-least-privilege intent is silently lost.Mitigations to consider:
- Document clearly what scopes
EXTERNAL_LABELLER_TOKENmust be created with (ideally onlypublic_repoor fine-grained withpull_requests:write+issues:write).- Add a comment in the workflow noting that
permissionsdoes not govern the PAT.Also applies to: 21-21
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/coderabbit-approval.yml around lines 7 - 10, The workflow's permissions block (permissions: contents/read, pull-requests/write, issues/write) only applies to the auto-generated GITHUB_TOKEN and is bypassed if EXTERNAL_LABELLER_TOKEN is a PAT; update the workflow to (1) add an inline comment above the permissions block and next to the EXTERNAL_LABELLER_TOKEN reference explicitly stating that PATs ignore the permissions block and carry their own scopes, and (2) document (in the workflow comments or repository CONTRIBUTING/SECURITY docs) the minimal required scopes for EXTERNAL_LABELLER_TOKEN (e.g., public_repo or fine-grained tokens with pull_requests:write and issues:write) so token creators know the least-privilege requirements.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In @.github/workflows/coderabbit-approval.yml:
- Around line 114-118: The "Summary" workflow step currently passes an elevated
token via the github-token input to actions/github-script; remove the
unnecessary elevated PAT by either deleting the github-token line or changing it
to use the default secrets.GITHUB_TOKEN (i.e., stop passing
secrets.EXTERNAL_LABELLER_TOKEN || secrets.GITHUB_TOKEN), so the Summary step
(which only console.logs) runs without the elevated token.
- Around line 7-10: The workflow's permissions block (permissions:
contents/read, pull-requests/write, issues/write) only applies to the
auto-generated GITHUB_TOKEN and is bypassed if EXTERNAL_LABELLER_TOKEN is a PAT;
update the workflow to (1) add an inline comment above the permissions block and
next to the EXTERNAL_LABELLER_TOKEN reference explicitly stating that PATs
ignore the permissions block and carry their own scopes, and (2) document (in
the workflow comments or repository CONTRIBUTING/SECURITY docs) the minimal
required scopes for EXTERNAL_LABELLER_TOKEN (e.g., public_repo or fine-grained
tokens with pull_requests:write and issues:write) so token creators know the
least-privilege requirements.
1 participant
…or GitHub actions
Addressed Issues:
Screenshots/Recordings:
Additional Notes:
Checklist
We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact.
Summary by CodeRabbit