fix: resolve GitHub Actions security vulnerabilities

[FelixMalfait]

🔒 Security Fixes

This PR addresses security vulnerabilities identified by GitHub CodeQL security scanning.

Changes

1. Fix Shell Command Injection (High Severity)

File: .github/workflows/docs-i18n-pull.yaml

Issue: Direct interpolation of ${{ github.head_ref }} in shell command was susceptible to command injection attacks.

Fix: Assign GitHub context variable to environment variable first:

run: |
  git push origin "HEAD:$HEAD_REF"
env:
  HEAD_REF: ${{ github.head_ref }}

This prevents malicious input from being executed as shell commands.

2. Add Missing Workflow Permissions (Medium Severity)

File: .github/workflows/ci-test-docker-compose.yaml

Issue: Workflow did not explicitly define GITHUB_TOKEN permissions, running with overly broad defaults.

Fix: Added explicit minimal permissions:

permissions:
  contents: read

This applies to all 3 jobs in the workflow:

• changed-files-check
• test
• ci-test-docker-compose-status-check

Security Impact

• ✅ Prevents potential shell injection attacks via pull request branch names
• ✅ Follows principle of least privilege for GitHub Actions tokens
• ✅ Aligns with GitHub Actions security best practices
• ✅ Resolves all CodeQL security alerts for these workflows

References

• GitHub Actions: Security hardening for GitHub Actions
• GitHub Actions: Permissions for the GITHUB_TOKEN
• Related attacks: 2025 Nx supply chain attack, 2024 ultralytics/actions attack

[greptile-apps]

Greptile Overview

Greptile Summary

This PR successfully addresses two critical security vulnerabilities identified by GitHub CodeQL scanning in GitHub Actions workflows.

Changes:

• Fixed high-severity shell injection vulnerability in .github/workflows/docs-i18n-pull.yaml by assigning github.head_ref to an environment variable before use
• Added explicit minimal permissions (contents: read) to .github/workflows/ci-test-docker-compose.yaml following the principle of least privilege
• Both changes align with GitHub Actions security best practices and eliminate potential attack vectors

The implementation is correct and consistent with other workflows in the repository that already follow these patterns.

Confidence Score: 5/5

• This PR is safe to merge with no risk
• Both security fixes are straightforward, well-documented, and follow established GitHub Actions security best practices. The shell injection fix uses the recommended pattern of environment variables, and the permissions change aligns with the principle of least privilege already used throughout the repository's other workflows.
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
.github/workflows/docs-i18n-pull.yaml	5/5	Fixed shell injection vulnerability by moving github.head_ref to environment variable instead of direct interpolation
.github/workflows/ci-test-docker-compose.yaml	5/5	Added explicit minimal permissions (contents: read) following principle of least privilege

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Actions
    participant Workflow as docs-i18n-pull.yaml
    participant Git as Git Repository
    participant Env as Environment Variables

    Note over Workflow: Pull Request Event Triggered
    GH->>Workflow: Trigger workflow with github.head_ref
    
    Note over Workflow,Env: Security Fix: Shell Injection Prevention
    Workflow->>Env: Set HEAD_REF=${{ github.head_ref }}
    Workflow->>Git: git push origin "HEAD:$HEAD_REF"
    Note over Workflow,Git: Environment variable prevents<br/>command injection attacks
    
    Note over GH,Workflow: Permissions Configuration
    Note over Workflow: ci-test-docker-compose.yaml
    GH->>Workflow: Grant minimal permissions<br/>(contents: read only)
    Workflow->>Git: Read repository contents
    Note over Workflow,Git: Principle of least privilege<br/>applied to GITHUB_TOKEN

Loading

[greptile-apps]

_{2 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}