From e9f98360b315d1913b487e5a984494f82ebed432 Mon Sep 17 00:00:00 2001
From: zufayu <zufa.yu@amd.com>
Date: Sat, 29 Aug 2026 12:55:41 +0000
Subject: [PATCH] [CI] Drop registry credentials after jobs on persistent
 runners (SEC-00837)

Mythos scan finding SEC-00837 (ROCM-26712): self-hosted runners are
non-ephemeral, so `docker login` credentials written by one job stay in
~/.docker/config.json and are readable by whatever runs next on that machine.

aiter-test.yaml has three `Docker login` steps and no `docker logout` anywhere:

  build_aiter_wheels  runs-on: build-only-aiter      (no cleanup step at all)
  standard            runs-on: ${{ matrix.runner }}  (has "Cleanup container")
  multi-gpu           runs-on: ${{ matrix.runner }}  (has "Cleanup container")

This adds `docker logout` to the two existing `Cleanup container` steps and
gives build_aiter_wheels the cleanup step it was missing. All three run under
`if: always()`.

This is the immediate mitigation the ticket calls for, not the fix. It narrows
the window but does not close it: credentials still exist on disk between login
and logout, and a cancelled job may skip cleanup entirely. The actual fix is to
register the runners with `--ephemeral` (or `ephemeral: true` under
actions-runner-controller) so every job starts from a clean machine. That lives
in the runner infrastructure, not in this repository.

Existing partial mitigation, unchanged by this PR: all three `Docker login`
steps are already gated on `!github.event.pull_request.head.repo.fork`, so fork
PRs never write credentials in the first place.

actionlint: clean.

Refs: ROCM-26712 / SEC-00837
---
 .github/workflows/aiter-test.yaml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/workflows/aiter-test.yaml b/.github/workflows/aiter-test.yaml
index 174f68a8c0..ab48baf3aa 100644
--- a/.github/workflows/aiter-test.yaml
+++ b/.github/workflows/aiter-test.yaml
@@ -358,6 +358,14 @@ jobs:
           compression-level: 0
           retention-days: 14
 
+      - name: Drop registry credentials
+        if: always()
+        run: |
+          # Self-hosted runners are persistent: drop the registry credentials
+          # written by the "Docker login" step so they do not outlive this job
+          # (SEC-00837 / ROCM-26712).
+          docker logout || true
+
   upload_s3_manifest:
     if: ${{ github.ref == 'refs/heads/main' && github.event_name != 'schedule' }}
     needs: [build_aiter_wheels]
@@ -950,6 +958,10 @@ jobs:
         if: always()
         run: |
           docker rm -f aiter_test || true
+          # Self-hosted runners are persistent: drop the registry credentials
+          # written by the "Docker login" step so they do not outlive this job
+          # (SEC-00837 / ROCM-26712).
+          docker logout || true
 
   standard-test-finish:
     if: >-
@@ -1222,6 +1234,10 @@ jobs:
         if: always()
         run: |
           docker rm -f aiter_test || true
+          # Self-hosted runners are persistent: drop the registry credentials
+          # written by the "Docker login" step so they do not outlive this job
+          # (SEC-00837 / ROCM-26712).
+          docker logout || true
 
       - name: Clean up Rocm processes
         if: always()