chore(ci): use workflow_run pattern for auto integ test to fix PR secret access#37333
Open
ozelalisen wants to merge 4 commits intomainfrom
Open
chore(ci): use workflow_run pattern for auto integ test to fix PR secret access#37333ozelalisen wants to merge 4 commits intomainfrom
ozelalisen wants to merge 4 commits intomainfrom
Conversation
The pull_request_review trigger has no access to repository secrets for fork PRs, breaking team membership checks and OIDC auth. Split into two-stage workflow_run pattern (matching pr-linter): - Stage 1 (trigger): Unprivileged pull_request_review saves PR metadata and snapshot check result as artifacts - Stage 2 (deployment): Privileged workflow_run downloads artifacts, validates team membership with secrets, runs integ tests
Add top-level actions:read permission required by actions/download-artifact@v8 when downloading cross-workflow artifacts via run-id. Without this, the artifact download fails with 403. Matches the pattern in codecov-upload.yml. Handle the case where the trigger workflow completes without uploading artifacts (no snapshot changes). Add continue-on-error on the download step, gate parsing on download success, and propagate has_context output to skip downstream jobs cleanly. Add explanatory comment for the 7200-minute timeout value.
- Validate artifact content (pr_number, head_sha, base_sha, reviewer) before use in privileged workflow_run context (defense-in-depth) - Add explicit status: completed to check run PATCH API call - Normalize job names to snake_case for consistency with existing integration-test-deployment.yml workflow - Align timeout-minutes comment with original workflow description
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+176
to
+194
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| CHECK_ID: ${{ steps.create_check.outputs.check_id }} | ||
| TEST_OUTCOME: ${{ steps.run_tests.outcome }} | ||
| run: | | ||
| if [ "$TEST_OUTCOME" = "success" ]; then | ||
| CONCLUSION="success" | ||
| TITLE="Integration tests passed" | ||
| SUMMARY="All integration tests passed for PR #${{ needs.pr_info.outputs.pr_number }}." | ||
| else | ||
| CONCLUSION="failure" | ||
| TITLE="Integration tests failed" | ||
| SUMMARY="Integration tests failed for PR #${{ needs.pr_info.outputs.pr_number }}. See [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details." | ||
| fi | ||
| gh api -X PATCH \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| -f status="completed" \ | ||
| -f conclusion="$CONCLUSION" \ | ||
| -f "output[title]=$TITLE" \ |
Check failure
Code scanning / CodeQL
Checkout of untrusted code in a privileged context Critical
Member
Author
There was a problem hiding this comment.
This is an accepted risk, the checkout of PR code in the privileged workflow_run context is required because integration tests need OIDC auth and AWS credentials that are only available in the base repo
context.
Mitigations in place:
- Code only executes after validate_approver confirms the reviewer is an active CDK team member (via gh api orgs/aws/teams/aws-cdk-team/memberships/)
Address GitHub Advanced Security findings: replace direct ${{ }}
interpolation of artifact-sourced values in shell run blocks with
environment variables to prevent potential code injection.
aws-cdk-automation
added
the
pr/needs-further-review
aws-cdk-automation
temporarily deployed
to
automation
GitHub Actions
Inactive
aws-cdk-automation
temporarily deployed
to
automation
GitHub Actions
Inactive
aws-cdk-automation
added
the
pr/needs-maintainer-review
aws-cdk-automation
temporarily deployed
to
automation
GitHub Actions
Inactive
aws-cdk-automation
temporarily deployed
to
automation
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reason for this change
pull_request_review trigger has no access to repository secrets for PRs, breaking team membership checks and OIDC auth in the auto integ test workflow.
Description of changes
Split into two-stage workflow_run pattern (matching pr-linter-review-trigger.yml → pr-linter.yml):
required status check.
Describe any new or updated permissions being added
Description of how you validated changes
Checklist