supabase / auth-js

81%

LAST BUILD ON BRANCH master

branch: master

CHANGE BRANCH

x

Reset

• master
• add-app-metadata-type
• add-siwe
• branch_with_test
• cemal/fix-replace-structuredclone
• chore-review-actions
• chore/add-preview-release
• chore/coverage-80
• chore/cross-repo-test
• chore/fix-preview-release
• chore/run-on-forks
• chore/secure-proof-workflows
• chore/test-prev
• chore/testing
• chore/upload-coverage
• cleanup-code-verifier
• dependabot/npm_and_yarn/example/react/babel/helpers-7.27.0
• dependabot/npm_and_yarn/example/react/babel/runtime-7.27.0
• dependabot/npm_and_yarn/example/react/babel/runtime-corejs3-7.26.10
• dependabot/npm_and_yarn/example/react/brace-expansion-1.1.12
• dependabot/npm_and_yarn/example/react/http-proxy-middleware-2.0.9
• dependabot/npm_and_yarn/example/react/multi-96c788614a
• dependabot/npm_and_yarn/example/react/nanoid-3.3.8
• dependabot/npm_and_yarn/example/react/serialize-javascript-6.0.2
• dependabot/npm_and_yarn/form-data-3.0.4
• dependabot/npm_and_yarn/koa-2.16.1
• dependabot/npm_and_yarn/test/form-data-4.0.4
• fix-decode-jwt-type
• fix/go-true-client-comment-typo
• fix/ssr-initialize-crash
• hf/ci-add-dogfooding
• hf/ci-provenance
• hf/export-process-lock
• hf/fallback-to-get-user-if-key-not-found
• hf/fix-current-session-split
• hf/get-claims-official
• hf/improve-insecure-user-warning
• hf/introduce-split-session-and-user-storage
• hf/link-identity-oidc
• hf/refactor-internal-types
• hf/remove-solana-dependency
• hf/revert-btoa-thing
• hf/session-expired-with-margin-no-autorefresh
• hf/validate-admin-api-uuid
• hf/web3
• issues/1076
• j0/add_firebase_scrypt
• j0/add_webauthn
• kiwicopple/add-throwOnError
• km/add-ttl-getclaims
• km/feat-get-claims
• more-tests
• refs/pull/1018/merge
• refs/pull/1053/merge
• refs/pull/1064/merge
• second_branch_with_tests
• tests
• tests2
• tests_again

Build # 17320322015

Build Type

push

github

Committed by web-flow

Commit Message

chore: secure-proof workflows (#1105)

## What kind of change does this PR introduce?

Proactive security hardening - implementing defense-in-depth for our
preview release workflow.

## What is the current behavior?

The current `preview-release.yml` workflow is **secure in practice** but
uses a pattern that could be theoretically vulnerable if our existing
safeguards were bypassed.

Current workflow security analysis:
- ✅ **Protected by maintainer-only label requirement** (`trigger:
preview`)
- ✅ **No code injection vulnerabilities** (no direct interpolation of
user input)
- ✅ **Limited permission scope** (only `pull-requests: write`)
- ⚠️ **Theoretical risk**: Uses `pull_request_target` while checking out
PR head code
- ⚠️ **Pattern concern**: Executes `npm ci` and `npm run build` from
forks in a context with secrets

**Important**: Our workflow was never vulnerable to the attacks seen in
the [recent
incident](https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c)
due to our security controls. However, in light of recent supply chain
attacks, we're implementing additional layers of security.

## What is the new behavior?

Implementing a **zero-trust architecture** that makes exploitation
impossible even if all other safeguards fail.

### New Three-Workflow Architecture:
1. **`preview-build.yml`** - Executes untrusted fork code in a
completely isolated environment (no secrets, minimal permissions)
2. **`trigger-tests.yml`** - Orchestrates testing using only artifacts
(never touches fork code, has access to secrets)
3. **`preview-comment.yml`** - Updates PR status (read-only operations
with artifacts)

### Security Improvements:

| Security Layer | Previous (Secure) | New (Defense-in-Depth) |
|---------------|-------------------|------------------------|
| **Maintainer Control** | ✅ Required label | ✅ Required label |
| **Code Injection Protection** | ✅ No interpolation | ✅ No
interpolation |
| **Fork Code Isolation** | ⚠️ Runs with secre... (continued)

Run Details

1080 of 1441 branches covered (74.95%)

Branch coverage included in aggregate %.

1451 of 1691 relevant lines covered (85.81%)

172.74 hits per line