Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test #9469

Closed
wants to merge 10 commits into from
+145 −99
Closed

Test #9469

Changes from 4 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
42ae69b
testing yaml file
manmeetnagii Dec 17, 2024
50f1b44
testing yaml file again
manmeetnagii Dec 17, 2024
64d1d02
back to original yaml
manmeetnagii Dec 17, 2024
7a25bca
testing yaml
manmeetnagii Dec 17, 2024
2a0160e
testing assrtList
manmeetnagii Dec 17, 2024
28cc4da
asset mb change
manmeetnagii Dec 17, 2024
beff1c7
set id as type exportitem
manmeetnagii Dec 17, 2024
eff81fb
Checking assetList
manmeetnagii Dec 17, 2024
27a9689
testing assetList.tsx
manmeetnagii Dec 17, 2024
e7d6c2e
change color
manmeetnagii Dec 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/cypress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,14 @@ on:
pull_request:
branches:
- develop
- test
- staging
workflow_dispatch:

jobs:
cypress-run:
permissions: write-all
if: github.repository == 'ohcnetwork/care_fe'
if: github.repository == 'manmeetnagii/care_fe'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codebase verification

⚠️ Potential issue

Repository condition change introduces security risks

The verification confirms critical security concerns:

  1. The workflow has write-all permissions and handles sensitive operations including:

    • Access to repository secrets (JWKS_BASE64, CYPRESS_RECORD_KEY)
    • Docker container operations with backend services
    • Cypress test execution with record capabilities

  2. All other security-critical workflows (CodeQL, OSSAR, deployments) are correctly restricted to 'ohcnetwork/care_fe', while this is the only workflow changed to run on a personal fork.

  3. The workflow already has proper fork handling through steps.pr_origin.outputs.is_forked conditions, making the repository check redundant and potentially harmful.

Recommendation:

-    if: github.repository == 'manmeetnagii/care_fe'
+    if: github.repository == 'ohcnetwork/care_fe'
🔗 Analysis chain

SECURITY RISK: Workflow configured for personal fork instead of main repository

This change presents several critical concerns:

  1. Security:

    • The workflow has write-all permissions and runs with sensitive secrets
    • Running on a personal fork increases security risks
    • Could potentially expose CYPRESS_RECORD_KEY and other secrets

  2. CI/CD Pipeline:

    • Tests will only run on 'manmeetnagii/care_fe'
    • Main repository ('ohcnetwork/care_fe') tests will be bypassed

Revert this change to maintain security and ensure proper CI/CD pipeline execution:

-    if: github.repository == 'manmeetnagii/care_fe'
+    if: github.repository == 'ohcnetwork/care_fe'

Let's verify the repository settings and permissions:

Let's examine the workflow file contents and any other repository conditions to better understand the security implications and verify if this is indeed a critical issue.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Check workflow permissions and secret usage
gh api repos/ohcnetwork/care_fe/actions/permissions
gh api repos/manmeetnagii/care_fe/actions/permissions

# List workflows using sensitive secrets
rg -l "secrets\." .github/workflows/

Length of output: 943

Script:

#!/bin/bash
# Check workflow permissions and secrets usage in cypress.yaml
cat .github/workflows/cypress.yaml

# Check for any other repository conditions in workflows
rg -p "github.repository ==" .github/workflows/

Length of output: 6137

runs-on: ubuntu-latest
strategy:
fail-fast: false
Expand Down
Loading