You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ci(website): keep the relay deploy trigger and assert run provenance - #1069
This patch mitigates privilege escalation via CI/CD in the 'deploy-website.yml' workflow by removing the unsafe 'workflow_run' trigger and its associated conditional logic from the 'on' section and 'if' expression, thereby preventing untrusted code execution through completed workflow runs that could bypass branch protection policies.
Related Issue
Motivation and Context
How Has This Been Tested?
Screenshots (if appropriate):
Types of changes
Non-functional change (docs, style, minor refactor)
Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Checklist:
My code follows the code style of this project.
My change requires a change to the documentation.
I have updated the documentation accordingly.
I have read the CONTRIBUTING document.
I have added tests to cover my code changes.
I added a changeset, or this is docs-only and I added an empty changeset.
All new and existing tests passed.
AI Confidence Level (confidence in the quality of this automated fix): Medium confidence: Aikido has validated similar fixes and observed positive outcomes. Validation is required.
Summary by CodeRabbit
Chores
Website deployments run after successful release workflows from the same repository or from manual runs on the main branch. Release workflows originating from forks do not trigger deployments.
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
No actionable comments were generated in the recent review.
Walkthrough
The website deployment workflow documents why it uses workflow_run and how its repository check excludes fork-originated Release runs. The deployment condition requires a successful run from the same repository.
Changes: Website deployment eligibility
Layer / File(s)
Summary
Document and restrict deployment eligibility .github/workflows/deploy-website.yml
Comments explain the workflow_run trigger constraint and fork-run check. The deployment condition requires head_repository.full_name to match github.repository.
cameri/nostream#1056: This PR adds the workflow_run deployment path that this change retains and restricts to runs from the same repository.
Merge Risk: Minimal · up to 05c28
The website deploy workflow now deploys only for Release runs that originate from this repository, which tightens the trigger without changing the existing deploy conditions. No merge-blocking risk is evident.
Architecture risk: Low · up to 382d1
The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.
Changed systems: None identified.
Architecture concerns
No architecture-level concerns identified.
Review details
Before / after behavior
observed — Modified behavior in .github/workflows/deploy-website.yml: Comments document why workflow_run is used instead of relying on release: published for relay tags, and identify the job’s head_repository condition as the fork-run exclusion.
observed — Modified behavior in .github/workflows/deploy-website.yml: The workflow_run deploy condition now requires the run’s head_repository.full_name to equal github.repository; previously this repository check was absent.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title describes the retained relay deploy trigger and the new run provenance check.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files.
Finishing Touches
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Tip
🎯 Customize your risk assessments
Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.
✅ Automatic approvals, with your rules
Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.
A rabbit checks the source of each run, Then lets the matching release through. Fork-born runs stay outside the gate, While relay tags can still deploy. Clear notes mark the workflow’s way, And hops keep website builds in view.
Recent review info
Automatic approval policy
Commit: 05c285300692.
Setting
Effective value
Source
Automatic approvals
Enabled
Global configuration
Merge risk
Minimal
Global configuration
Security risk
Not set
Global configuration
Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: dbfd4f44-711c-4f16-972e-884ba6a89d1d
Commits
Reviewing files that changed from the base of the PR and between 33fc5de and 05c2853.
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.
Removing workflow_run does not harden the deploy, it deletes it: the website
environment admits only main and nostream-website@*, and a release event is
checked against the tag, so nostream@X.Y.Z is refused there whatever the job
does. That is the constraint the trigger exists for, and dropping it re-creates
the staleness fixed on 2026-11-05.
The reported escalation is closed instead by requiring the triggering run to
belong to this repository (head_repository.full_name == github.repository),
which a fork's Release workflow can never satisfy, alongside the existing
conclusion and branch-prefix checks.
chappie-daemon
changed the title
[Aikido] AI Fix for Using unsafe GitHub Actions trigger may allow privilege escalation via CI/CD
ci(website): keep the relay deploy trigger and assert run provenance
Nov 7, 2026
The finding stands, the patch did not. I replaced it on this branch with commit 382d1f6.
Why removing workflow_run is not a hardening. The website environment's deployment branch policy admits only main and the tag nostream-website@* — I read the policy through the API rather than trusting the workflow's comment. A deployment is checked against its own run's ref, and a release: published run for nostream@X.Y.Z carries the tag as its ref, so the environment refuses it whatever the job does. workflow_run is the only event that lands on the default branch after a relay release publishes an image. Deleting it restores the exact staleness fixed on 2026-11-05, when nostream.dev served v3.9.0 through six relay releases because the site's version badge and changelog are read from the repo at build time.
What actually closes the escalation. The deploy job now requires the triggering run to belong to this repository:
A Release run from a fork can never satisfy that, and the existing conclusion, tag-prefix and dispatch-on-main checks are unchanged; the job keeps permissions: contents: read and its own concurrency group. The workflow comment now records why the trigger cannot simply be removed, so a future report does not re-open this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Description
This patch mitigates privilege escalation via CI/CD in the 'deploy-website.yml' workflow by removing the unsafe 'workflow_run' trigger and its associated conditional logic from the 'on' section and 'if' expression, thereby preventing untrusted code execution through completed workflow runs that could bypass branch protection policies.
Related Issue
Motivation and Context
How Has This Been Tested?
Screenshots (if appropriate):
Types of changes
Checklist:
AI Confidence Level (confidence in the quality of this automated fix): Medium confidence: Aikido has validated similar fixes and observed positive outcomes. Validation is required.
Summary by CodeRabbit