5 ms·

> but not higher-trust GHA CD ones They improved this quite a bit last June. https://github.blog/changelog/2021-06-22-github-actions-environments-environment-p

> but not higher-trust GHA CD ones They improved this quite a bit last June. https://github.blog/changelog/2021-06-22-github-actions-environments-environment-protection-rules-and-environment-secrets-are-generally-available/ https://github.blog/changelog/2021-06-22-github-actions-envi... Basically you can define deployment environments which have their own secrets and configure it so only authorized users can approve workflows which access those environments.

lmeyerov 5y ago
Ah this is a good step. I hadn't looked since the env var vulns earlier in the ~year. Add in GH runner domain/vpc safelisting and a lot of the basics get solved!
- jeremyepling 5y ago
  I think these will solve that. If not, let me know. https://github.com/github/roadmap/issues/249 https://github.com/github/roadmap/issues/249 https://github.com/github/roadmap/issues/220 https://github.com/github/roadmap/issues/220
  - lmeyerov 5y ago
    the first commenter was right on the env thing helping with ci/cd secret isolation the open issue is that GHA env is vulnerable to typical npm/pip/conda/etc supply chain attacks. it lets them do funny network requests (both data exfil + integrity, and even quota wastage / DoS): - GitHub hosted runners should allow inbound/outbound domain safelists, full isolation w internal repo safelisting, or something else like it - and/or self-hosted runners should have an Azure serverless mode where the host owner can do their own presets. less good b/c trickier to maintain typical safelists currently , GHA is default-allow for supply chain attacks =\ in theory folks can try docker-in-docker to limit network access, or the equiv lower, and layer on internal repos to prevent 0-days, but this gets gnarly quickly and more sanely handled by the managed CI env we are all paying for

5 ms·

> but not higher-trust GHA CD ones They improved this quite a bit last June. https://github.blog/changelog/2021-06-22-github-actions-environments-environment-p

by Pathogen-David 5y ago

lmeyerov 5y ago
Ah this is a good step. I hadn't looked since the env var vulns earlier in the ~year. Add in GH runner domain/vpc safelisting and a lot of the basics get solved!
- jeremyepling 5y ago
  I think these will solve that. If not, let me know. https://github.com/github/roadmap/issues/249 https://github.com/github/roadmap/issues/249 https://github.com/github/roadmap/issues/220 https://github.com/github/roadmap/issues/220
  - lmeyerov 5y ago
    the first commenter was right on the env thing helping with ci/cd secret isolation the open issue is that GHA env is vulnerable to typical npm/pip/conda/etc supply chain attacks. it lets them do funny network requests (both data exfil + integrity, and even quota wastage / DoS): - GitHub hosted runners should allow inbound/outbound domain safelists, full isolation w internal repo safelisting, or something else like it - and/or self-hosted runners should have an Azure serverless mode where the host owner can do their own presets. less good b/c trickier to maintain typical safelists currently , GHA is default-allow for supply chain attacks =\ in theory folks can try docker-in-docker to limit network access, or the equiv lower, and layer on internal repos to prevent 0-days, but this gets gnarly quickly and more sanely handled by the managed CI env we are all paying for