fix(post-code): block workflow file changes and correct token docs - #2656
fix(post-code): block workflow file changes and correct token docs#2656ascerra wants to merge 1 commit into
Conversation
E2E tests did not runE2E tests run automatically for org/repo members and collaborators on pull requests. For other contributors, a maintainer must add the See E2E testing guide for details. |
PR Summary by QodoHarden post-code: block workflow changes and fix sandbox token docs Description
Diagram
High-Level Assessment
Files changed (3)
|
Site previewPreview: https://31969fd4-site.fullsend-ai.workers.dev Commit: |
The code-agent.env comment falsely claimed the sandbox GH_TOKEN was read-only (contents:read, issues:read, pull_requests:read). In reality the mint service grants the coder role contents:write, issues:write, pull_requests:write, checks:read — the same token used as PUSH_TOKEN on the runner. Correct the comment to reflect the actual token scope and add a TODO for minting a separate read-only sandbox token. Add a defense-in-depth block in post-code.sh that rejects any agent commit touching .github/workflows/ before push. The coder token already omits workflows:write so GitHub would reject the push server-side, but an explicit script-level gate ensures the protection survives future role changes or GitHub permission model shifts. This addresses the prompt injection attack vector where a malicious issue comment could cause the code agent to create a workflow file that executes arbitrary code on the org's runner with access to repo secrets. Closes #2654 Signed-off-by: Adam Scerra <ascerra@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
321759d to
4fa4034
Compare
|
🤖 Finished Review · ✅ Success · Started 1:59 PM UTC · Completed 2:12 PM UTC |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Code Review by Qodo
1. Workflow tests duplicate logic
|
ReviewFindingsHigh
Medium
Labels: PR adds security hardening to sandbox post-scripts and corrects token scope documentation |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| # rejects pushes that modify .github/workflows/ files. | ||
| export GH_TOKEN=${GH_TOKEN} | ||
|
|
||
| # Git identity — uses the GitHub App bot user's noreply email so GitHub |
There was a problem hiding this comment.
[high] secret-exposure
The sandbox receives a GH_TOKEN with contents:write, issues:write, pull_requests:write, and checks:read permissions (the coder role token). This is the same token used as PUSH_TOKEN on the runner (confirmed via internal/mintcore/github.go canonicalRolePermissions and internal/cli/run.go roleTokenVars). The sandbox agent can use this token to push code directly, bypassing post-code.sh gates. The PR body acknowledges this and mentions a TODO for minting a separate read-only sandbox token, but that TODO is not present in the diff.
Suggested fix: Mint a separate read-only token for the sandbox (contents:read, issues:read, pull_requests:read). The coder token with write permissions should only be available to the runner post-script.
There was a problem hiding this comment.
not in-scope for this PR! We do have an issue: #2826
fullsend-ai-review
Bot
added
security
rh-hemartin
left a comment
rh-hemartin
left a comment
There was a problem hiding this comment.
LGTM but what about the fix agent?
ralphbean
left a comment
ralphbean
left a comment
There was a problem hiding this comment.
This is an automated comment. We are moving agent content from internal/scaffold/fullsend-repo/ to https://github.com/fullsend-ai/agents -- changes should be made to agent definitions there going forwards.
|
@ifireball ack I created this quickly as we were discussing internally how to improve topics around agent privilege. I believe this is more of a workaround for what I believe is the most important thing to solve which is #2826 from your planned work. I will close this as I believe that is the better direction for us to be focussed on. |
|
Remember to delete the branch if you don't need it anymore. |
|
🤖 Finished Retro · ✅ Success · Started 3:13 PM UTC · Completed 3:21 PM UTC |
|
PR #2656 was a human-authored security hardening PR by ascerra that corrected misleading token scope documentation in The review agent performed well in some areas: it correctly identified that Two proposals target these review quality gaps. Proposals filed
|
4 participants
Summary
Corrects misleading
code-agent.envcomment that claimed the sandboxGH_TOKENwas read-only (contents:read, issues:read, pull_requests:read). The mint service actually grantscontents:write, issues:write, pull_requests:write, checks:read— the same token used asPUSH_TOKENon the runner. Adds a TODO for minting a separate read-only sandbox token.Adds
.github/workflows/block inpost-code.shas defense-in-depth. The coder token already omitsworkflows:write(GitHub rejects the push server-side), but an explicit script-level gate ensures protection survives future role changes or GitHub permission model shifts. Addresses the prompt injection attack vector where a malicious issue comment could cause the code agent to create a workflow file that executes arbitrary code on the org's runner with access to repo secrets.Adds 6 unit tests for the workflow file detection logic in
post-code-test.sh.Context
Discussion from today's fullsend team sync on code agent security (Barak's concern about elevated privileges + prompt injection). See meeting notes and Slack thread for full context.
Test plan
::error::output) which was fixed before pushMade with Cursor