Security: Prevent CI secret exposure in Git remote URLs - #1
Open
mertcano wants to merge 1 commit into
Open
Conversation
Why The scheduled sync workflow previously interpolated secrets.FORK_PAT directly into clone and remote URLs. This critical anti-pattern exposed the credential in command-line arguments and persisted it within the Git remote configuration. How Refactored the authentication mechanism to use an ephemeral http.extraheader injected securely through Git's environment configuration (GIT_CONFIG_COUNT, GIT_CONFIG_KEY_0, GIT_CONFIG_VALUE_0). Removed all token references from the git clone, git remote set-url, and git remote add URLs, keeping them strictly credential-free. Enabled set -euo pipefail to enforce strict bash error handling and pipeline failure propagation. Security/Robustness changes Eliminates credential leakage in the CI/CD pipeline, ensuring tokens are not inadvertently logged or exposed to local/downstream processes inspecting .git/config. Testing Verified that changed-file secret scanning passes and that token-bearing Git URLs are no longer present after remediation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The scheduled sync workflow previously interpolated secrets.FORK_PAT directly into clone and remote URLs. This critical anti-pattern exposed the credential in command-line arguments and persisted it within the Git remote configuration.
How
Refactored the authentication mechanism to use an ephemeral http.extraheader injected securely through Git's environment configuration (GIT_CONFIG_COUNT, GIT_CONFIG_KEY_0, GIT_CONFIG_VALUE_0). Removed all token references from the git clone, git remote set-url, and git remote add URLs, keeping them strictly credential-free. Enabled set -euo pipefail to enforce strict bash error handling and pipeline failure propagation.
Security/Robustness changes
Eliminates credential leakage in the CI/CD pipeline, ensuring tokens are not inadvertently logged or exposed to local/downstream processes inspecting .git/config.
Testing
Verified that changed-file secret scanning passes and that token-bearing Git URLs are no longer present after remediation.