|
| 1 | +"""Verify self-hosted runners are not reachable from public PR workflows.""" |
| 2 | + |
| 3 | +from __future__ import annotations |
| 4 | + |
| 5 | +import argparse |
| 6 | +import json |
| 7 | +from pathlib import Path |
| 8 | +from typing import Any |
| 9 | + |
| 10 | +import yaml |
| 11 | + |
| 12 | + |
| 13 | +CANONICAL_REPOS = ( |
| 14 | + ".github", |
| 15 | + "hawkinsoperations-detections", |
| 16 | + "hawkinsoperations-validation", |
| 17 | + "hawkinsoperations-platform", |
| 18 | + "hawkinsoperations-proof", |
| 19 | + "hawkinsoperations-website", |
| 20 | +) |
| 21 | +PUBLIC_PR_TRIGGERS = {"pull_request", "pull_request_target"} |
| 22 | + |
| 23 | + |
| 24 | +def workflow_trigger_keys(workflow: dict[str, Any]) -> set[str]: |
| 25 | + on_value = workflow.get("on", workflow.get(True)) |
| 26 | + if isinstance(on_value, str): |
| 27 | + return {on_value} |
| 28 | + if isinstance(on_value, list): |
| 29 | + return {str(item) for item in on_value} |
| 30 | + if isinstance(on_value, dict): |
| 31 | + return {str(key) for key in on_value} |
| 32 | + return set() |
| 33 | + |
| 34 | + |
| 35 | +def runs_on_values(runs_on: Any) -> list[str]: |
| 36 | + if isinstance(runs_on, str): |
| 37 | + return [runs_on] |
| 38 | + if isinstance(runs_on, list): |
| 39 | + return [str(item) for item in runs_on] |
| 40 | + return [] |
| 41 | + |
| 42 | + |
| 43 | +def is_self_hosted(runs_on: Any) -> bool: |
| 44 | + return any(value == "self-hosted" for value in runs_on_values(runs_on)) |
| 45 | + |
| 46 | + |
| 47 | +def load_workflow(path: Path) -> dict[str, Any]: |
| 48 | + with path.open("r", encoding="utf-8") as handle: |
| 49 | + parsed = yaml.safe_load(handle) or {} |
| 50 | + if not isinstance(parsed, dict): |
| 51 | + return {} |
| 52 | + return parsed |
| 53 | + |
| 54 | + |
| 55 | +def workflow_files(repo_path: Path) -> list[Path]: |
| 56 | + workflow_dir = repo_path / ".github" / "workflows" |
| 57 | + if not workflow_dir.exists(): |
| 58 | + return [] |
| 59 | + return sorted( |
| 60 | + path |
| 61 | + for pattern in ("*.yml", "*.yaml") |
| 62 | + for path in workflow_dir.glob(pattern) |
| 63 | + if path.is_file() |
| 64 | + ) |
| 65 | + |
| 66 | + |
| 67 | +def scan_repo(repo_name: str, repo_path: Path) -> list[dict[str, str]]: |
| 68 | + findings: list[dict[str, str]] = [] |
| 69 | + for workflow_path in workflow_files(repo_path): |
| 70 | + workflow = load_workflow(workflow_path) |
| 71 | + triggers = workflow_trigger_keys(workflow) |
| 72 | + public_triggers = sorted(triggers & PUBLIC_PR_TRIGGERS) |
| 73 | + if not public_triggers: |
| 74 | + continue |
| 75 | + |
| 76 | + jobs = workflow.get("jobs", {}) |
| 77 | + if not isinstance(jobs, dict): |
| 78 | + continue |
| 79 | + |
| 80 | + for job_name, job in jobs.items(): |
| 81 | + if not isinstance(job, dict): |
| 82 | + continue |
| 83 | + runs_on = job.get("runs-on") |
| 84 | + if not is_self_hosted(runs_on): |
| 85 | + continue |
| 86 | + findings.append( |
| 87 | + { |
| 88 | + "repo": repo_name, |
| 89 | + "workflow_path": str(workflow_path), |
| 90 | + "job_name": str(job_name), |
| 91 | + "trigger": ",".join(public_triggers), |
| 92 | + "runs_on": json.dumps(runs_on), |
| 93 | + } |
| 94 | + ) |
| 95 | + return findings |
| 96 | + |
| 97 | + |
| 98 | +def scan_canonical_repos(org_root: Path) -> tuple[list[dict[str, str]], list[str]]: |
| 99 | + findings: list[dict[str, str]] = [] |
| 100 | + missing: list[str] = [] |
| 101 | + for repo_name in CANONICAL_REPOS: |
| 102 | + repo_path = org_root / repo_name |
| 103 | + if not repo_path.exists(): |
| 104 | + missing.append(str(repo_path)) |
| 105 | + continue |
| 106 | + findings.extend(scan_repo(repo_name, repo_path)) |
| 107 | + return findings, missing |
| 108 | + |
| 109 | + |
| 110 | +def default_org_root() -> Path: |
| 111 | + return Path(__file__).resolve().parents[2] |
| 112 | + |
| 113 | + |
| 114 | +def main() -> int: |
| 115 | + parser = argparse.ArgumentParser( |
| 116 | + description="Verify public PR workflows do not run on self-hosted runners." |
| 117 | + ) |
| 118 | + parser.add_argument( |
| 119 | + "--org-root", |
| 120 | + type=Path, |
| 121 | + default=default_org_root(), |
| 122 | + help="Path containing the six canonical HawkinsOperations repositories.", |
| 123 | + ) |
| 124 | + parser.add_argument( |
| 125 | + "--allow-missing", |
| 126 | + action="store_true", |
| 127 | + help="Do not fail if one or more canonical repositories are absent.", |
| 128 | + ) |
| 129 | + args = parser.parse_args() |
| 130 | + |
| 131 | + findings, missing = scan_canonical_repos(args.org_root) |
| 132 | + if missing and not args.allow_missing: |
| 133 | + print("CANONICAL_REPO_SCAN=FAIL") |
| 134 | + for repo_path in missing: |
| 135 | + print(f"missing_repo={repo_path}") |
| 136 | + return 1 |
| 137 | + |
| 138 | + if findings: |
| 139 | + print("PUBLIC_PR_SELF_HOSTED_EXPOSURE=FAIL") |
| 140 | + for finding in findings: |
| 141 | + print( |
| 142 | + "exposure=" |
| 143 | + f"repo={finding['repo']};" |
| 144 | + f"workflow={finding['workflow_path']};" |
| 145 | + f"job={finding['job_name']};" |
| 146 | + f"trigger={finding['trigger']};" |
| 147 | + f"runs_on={finding['runs_on']}" |
| 148 | + ) |
| 149 | + return 1 |
| 150 | + |
| 151 | + print("PUBLIC_PR_SELF_HOSTED_EXPOSURE=PASS") |
| 152 | + print(f"canonical_repos_scanned={len(CANONICAL_REPOS) - len(missing)}") |
| 153 | + return 0 |
| 154 | + |
| 155 | + |
| 156 | +if __name__ == "__main__": |
| 157 | + raise SystemExit(main()) |
0 commit comments