 Félix Malfait
|
fc6b136c2f
|
fix: resolve GitHub Actions security vulnerabilities (#16174)
## 🔒 Security Fixes
This PR addresses security vulnerabilities identified by GitHub CodeQL
security scanning.
### Changes
#### 1. Fix Shell Command Injection (High Severity)
**File:** `.github/workflows/docs-i18n-pull.yaml`
**Issue:** Direct interpolation of `${{ github.head_ref }}` in shell
command was susceptible to command injection attacks.
**Fix:** Assign GitHub context variable to environment variable first:
```yaml
run: |
git push origin "HEAD:$HEAD_REF"
env:
HEAD_REF: ${{ github.head_ref }}
```
This prevents malicious input from being executed as shell commands.
#### 2. Add Missing Workflow Permissions (Medium Severity)
**File:** `.github/workflows/ci-test-docker-compose.yaml`
**Issue:** Workflow did not explicitly define GITHUB_TOKEN permissions,
running with overly broad defaults.
**Fix:** Added explicit minimal permissions:
```yaml
permissions:
contents: read
```
This applies to all 3 jobs in the workflow:
- `changed-files-check`
- `test`
- `ci-test-docker-compose-status-check`
### Security Impact
- ✅ Prevents potential shell injection attacks via pull request branch
names
- ✅ Follows principle of least privilege for GitHub Actions tokens
- ✅ Aligns with GitHub Actions security best practices
- ✅ Resolves all CodeQL security alerts for these workflows
### References
- [GitHub Actions: Security hardening for GitHub
Actions](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)
- [GitHub Actions: Permissions for the
GITHUB_TOKEN](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
- Related attacks: 2025 Nx supply chain attack, 2024 ultralytics/actions
attack
|
2025-11-28 13:15:33 +01:00 |
|
|
github-actions[bot]
|
e02c24bd3a
|
i18n - docs translations (#15904)
Created by Github action
---------
Co-authored-by: Abdul Rahman <ar5438376@gmail.com>
Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
Co-authored-by: github-actions <github-actions@twenty.com>
Co-authored-by: Charles Bochet <charles@twenty.com>
|
2025-11-18 17:21:48 +01:00 |
|
|
Abdul Rahman
|
c0bae491e1
|
docs: localize navigation tabs and groups for supported locales (#15811)
|
2025-11-14 22:03:54 +01:00 |
|
|
Abdul Rahman
|
4182209ee1
|
Docs/organize locales under l (#15730)
|
2025-11-09 14:02:21 +01:00 |
|
|
github-actions[bot]
|
1bd1165d2e
|
i18n - docs translations (#15724)
Created by Github action
---------
Co-authored-by: Abdul Rahman <ar5438376@gmail.com>
Co-authored-by: github-actions <github-actions@twenty.com>
|
2025-11-08 21:20:40 +01:00 |
|
|
Abdul Rahman
|
f740bac988
|
add documentation i18n workflows for Crowdin (#15538)
Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Félix Malfait <felix@twenty.com>
|
2025-11-08 11:24:07 +01:00 |
|