ci: restrict sensitive workflow jobs to upstream repository only#5052
Merged
Conversation
Contributor
Summary by CodeRabbit
WalkthroughThe workflows add fork checks that skip CI/CD, CodeQL, and dependency-review jobs on forked repositories. ChangesFork checks across workflows
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found across 7 files
Confidence score: 2/5
- In
.github/workflows/run-code-tests.yaml, the fork check usesgithub.event.repository.fork == false, which still allows fork-originatedpull_requestruns because that field points to the base repo; merging as-is can execute untrusted fork code under the upstream workflow context and expose CI resources/secrets if any are available — switch the gate to a head-repo/fork-aware condition (for example usinggithub.event.pull_request.head.repo.forkor equivalent) before merging.
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/code-ql-actions.yaml:
- Line 31: The job condition is checking the PR head repository fork status,
which wrongly skips CodeQL for upstream pull requests from forks; update the
workflow gate in the CodeQL job to rely on the repository running the workflow
instead of github.event.pull_request.head.repo.fork, so execution is restricted
only when the workflow itself is in a forked repository. Use the existing
workflow job condition around the CodeQL action to apply the fix consistently.
In @.github/workflows/code-ql-javascript-typescript.yaml:
- Line 47: The fork guard in the CodeQL workflow is checking the pull request
source repo instead of the repository running the workflow, which skips upstream
scanning for contributor forks. Update the conditional on the workflow job to
use the repository context from the workflow runtime, not
pull_request.head.repo.fork, and keep the restriction scoped to the current
repo. Use the workflow job condition around the CodeQL scan step in
code-ql-javascript-typescript.yaml to locate and adjust this logic.
In @.github/workflows/code-ql-python.yaml:
- Line 37: The CodeQL workflow condition is checking the pull request source
repo rather than whether the workflow is running in the upstream repository.
Update the `if` guard in the Python CodeQL workflow so it distinguishes upstream
execution from forked-repo execution, not just
`github.event.pull_request.head.repo.fork`. Use the existing workflow context
around the `if:` condition to allow Python CodeQL to run for upstream PRs,
including external-contributor PRs opened against the upstream repo, while still
skipping true fork-origin executions as intended.
In @.github/workflows/dependency-review.yaml:
- Line 24: The dependency review condition is checking the pull request source
repository via github.event.pull_request.head.repo.fork, which skips forked PRs
instead of restricting execution to the current repo. Update the workflow gate
in dependency-review to use the repository running the workflow (for example,
the base/current repository context) so dependency review only runs for upstream
repository executions, and keep the condition aligned with the intended “current
repository only” behavior.
In @.github/workflows/run-code-tests.yaml:
- Line 13: The shared workflow gate is using PR-event-only fork detection, which
still allows non-PR events from forked repositories to pass and lets the
coverage upload jobs run. Update the condition in the workflow that guards the
upload jobs to use repository-level fork detection instead of
github.event.pull_request null checks, and apply it consistently wherever the
shared gate is reused so both upload paths stay upstream-only.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: b3fd75d4-e16b-4dd8-bab7-84347961abdf
📒 Files selected for processing (5)
.github/workflows/code-ql-actions.yaml.github/workflows/code-ql-javascript-typescript.yaml.github/workflows/code-ql-python.yaml.github/workflows/dependency-review.yaml.github/workflows/run-code-tests.yaml
Contributor
There was a problem hiding this comment.
4 issues found across 5 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
devnchill
force-pushed
the
ci/skip-some-actions-on-forks
branch
from
d287f54 to
bb04f57
Compare
arkid15r
requested changes
Jun 26, 2026
arkid15r
left a comment
arkid15r
left a comment
Collaborator
There was a problem hiding this comment.
It looks like only ci-cd-staging needs this (we can also keep it for production just for consistency).
arkid15r
approved these changes
Jun 27, 2026
Contributor
There was a problem hiding this comment.
1 issue found across 4 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/code-ql-actions.yaml">
<violation number="1">
P1: Fork-restriction guard was removed from the CodeQL Actions job, causing it to run in forked repositories contrary to the PR's stated objective of restricting sensitive jobs to the upstream repository only.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5052 +/- ##
=======================================
Coverage 98.74% 98.74%
=======================================
Files 539 539
Lines 17069 17069
Branches 2421 2421
=======================================
Hits 16854 16854
Misses 123 123
Partials 92 92
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
Contributor
Author
Hmm the tests already had it to prevent coverage upload from running |
kasya
approved these changes
Jun 27, 2026
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed change
Resolves #4968
Add the PR description here.
Adds
if: github.event.repository.fork == falseto some jobs to skip running in forked repos.I wanted to get some clarification on following
many
workflow_callare being protected indirectly through their callers so i skipped ading checks for them individually , do I need to add them ?some files just have 1 job with fork check already, i left it that way, not sure if i need to create a separate job and then add it as
needsfor these tooChecklist