Preview issue triage prompt changes#20352
Conversation
Issue triage previewThe issue triage preview is available in the workflow run summary. |
uv test inventory changesThis PR no longer changes the tests when compared with the |
ab6d0b7 to
61e8e15
Compare
a19d1b6 to
7c25249
Compare
![astral-automations-bot[bot]](https://avatars.githubusercontent.com/in/4307167?s=60&v=4){kind=small}
| uses: ./.github/workflows/issue-triage.yml # zizmor: ignore[secrets-inherit] Required for environment secrets in reusable workflows. | ||
| with: | ||
| issue: ${{ matrix.issue }} | ||
| secrets: inherit |
There was a problem hiding this comment.
[P2] Do not run PR-controlled workflows with environment secrets
This local reusable workflow is resolved from the pull request revision, and its triage job enters the unprotected automations environment and receives OPENAI_API_KEY. Consequently, anyone able to push a same-repository branch can modify the called workflow or its Codex configuration and expose or misuse that credential before review. The same-repository check only excludes forks; it does not establish that the executed revision is trusted. Keep this preview secretless, or move the credentialed stage to protected default-branch workflow code behind an exact-SHA-bound approval and environment protection.
There was a problem hiding this comment.
I don't think this is legitimate?
There was a problem hiding this comment.
same repo branch == a maintainer's branch, so, likely not?
| uses: ./.github/workflows/issue-triage.yml # zizmor: ignore[secrets-inherit] Required for environment secrets in reusable workflows. | ||
| with: | ||
| issue: ${{ matrix.issue }} | ||
| secrets: inherit |
There was a problem hiding this comment.
[P2] Prevent PR-controlled workflows from receiving automation secrets
This pull_request workflow invokes a repository-local reusable workflow from the pull request revision and passes secrets: inherit; that called workflow enters the automations environment and consumes OPENAI_API_KEY. A same-repository branch writer can therefore change any listed prompt/schema to trigger the run while also changing .github/workflows/issue-triage.yml, causing unreviewed code to receive or exfiltrate the environment credential before merge. The head-repository check blocks forks but does not establish that the branch author is entitled to environment secrets. Keep the PR stage secretless, or move API-backed processing behind an explicitly authorized stage that runs trusted default-branch code and treats PR content only as data.
There was a problem hiding this comment.
We should probably add some notes to the threat-model about this.
3 participants
Summary
Stacked on #20340.
Add a pull-request workflow that previews changes to
agents/prompts/triage-issue.mdagainst the five most recently created issues. Each issue is triaged independently with read-only repository access, then the results are consolidated into a single marked PR comment that is updated on subsequent runs.The preview is restricted to same-repository PRs, leaves the Codex action's write-access actor restriction in place, and grants write permission only to the final PR-comment job. It does not modify issues or invoke release workflows.
Validation
npx prettier@3.9.0 --check .github/workflows/issue-triage-preview.ymlgit diff --cached --check