Potential fix for code scanning alert no. 41: Checkout of untrusted code in a non-privileged context

Draft
DO
1mo ago
+16-1

Potential fix for https://github.com/petry-projects/.github-private/security/code-scanning/41

To fix this safely without changing intended functionality, enforce that inputs.agent_ref is a pinned commit SHA before checkout, and use that validated value for the .github-private checkout. This preserves the existing behavior (still caller-selectable ref) while preventing mutable/untrusted refs like branch names or tags from being used.

Best single fix in this file:

  1. Add a validation step before “Checkout dev-lead scripts” that:
    • fails if inputs.agent_ref is empty
    • fails unless it matches a full 40-hex commit SHA
    • exports the validated ref to GITHUB_ENV (e.g., SAFE_AGENT_REF)
  2. Change the checkout step to use ref: ${{ env.SAFE_AGENT_REF }} instead of raw input.

Edits are only in .github/workflows/dev-lead-reusable.yml, around lines 791–797.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Problem

See the linked issue.

Risk

Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.

Test plan

No test files were added or updated. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the existing CI (bats + lint) guards the change.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.