Skip to content

OSAC-3734: add auto-queue workflow for merge queue #216

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
omer-vishlitzky merged 1 commit into from
Aug 9, 2026
Merged

OSAC-3734: add auto-queue workflow for merge queue #216

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions .github/workflows/auto-queue.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,6 @@ on:
types: [opened, ready_for_review]
branches: [main]

permissions:
contents: write
pull-requests: write

jobs:
enable-auto-merge:
if: >-
Expand All @@ -19,5 +15,5 @@ jobs:
steps:
- name: Enable auto-merge
env:
GH_TOKEN: ${{ github.token }}
GH_TOKEN: ${{ secrets.MERGE_QUEUE_TOKEN }}
run: gh pr merge ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --auto --rebase
Comment on lines +18 to 19

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

workflow=".github/workflows/auto-queue.yml"

if ! rg -q '^permissions:\s*\{\}\s*$' "$workflow"; then
  echo "Missing explicit permissions: {} in $workflow" >&2
  exit 1
fi

rg -n 'permissions:|GH_TOKEN:|github\.token|MERGE_QUEUE_TOKEN' "$workflow"

Repository: osac-project/osac

Length of output: 224

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
workflow=".github/workflows/auto-queue.yml"
printf '--- file lines ---\n'
cat -n "$workflow" | sed -n '1,220p'
printf '\n--- relevant permissions/env/token searches ---\n'
rg -n '^\s*permissions:|GH_TOKEN:|GITHUB_TOKEN|github\.token|MERGE_QUEUE_TOKEN|gh pr merge' "$workflow" || true
printf '\n--- referenced PR workflow snippets: lines 1-80 ---\n'
sed -n '1,80p' "$workflow"

Repository: osac-project/osac

Length of output: 246

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
workflow=".github/workflows/auto-queue.yml"
printf '%s\n' '--- file lines ---'
cat -n "$workflow" | sed -n '1,220p'
printf '%s\n' ''
printf '%s\n' '--- relevant permissions/env/token searches ---'
rg -n 'permissions:|GH_TOKEN:|GITHUB_TOKEN|github\.token|MERGE_QUEUE_TOKEN|gh pr merge' "$workflow" || true
printf '%s\n' ''
printf '%s\n' '--- referenced PR workflow snippets: lines 1-80 ---'
sed -n '1,80p' "$workflow"

Repository: osac-project/osac

Length of output: 1689

🌐 Web query:

GitHub Actions workflows top-level GITHUB_TOKEN permissions default write contents pull_request_target

💡 Result:

In GitHub Actions, the GITHUB_TOKEN is a short-lived authentication token generated for each workflow job [1][2]. Its default permissions are governed by repository or organization settings [3][1]. Default Permissions By default, GitHub repositories may be configured to grant the GITHUB_TOKEN read and write access for all scopes, or a more restricted "read contents" default [3][1]. Because these defaults can be permissive, GitHub security documentation strongly recommends adopting the principle of least privilege by explicitly configuring permissions within the workflow file [4][5]. The pull_request_target Event The pull_request_target trigger is inherently different from the standard pull_request event [6][7]. While the standard pull_request event runs using the code from the pull request's merge commit and is restricted to a read-only GITHUB_TOKEN (without secret access) to prevent abuse [6][8], the pull_request_target event runs in the context of the base repository's default branch [6][7]. Because the pull_request_target event executes code trusted by the base repository, it is granted access to repository secrets and a GITHUB_TOKEN that defaults to read/write permissions [6][7]. If a workflow triggered by pull_request_target checks out code from an untrusted fork without careful handling, it creates a significant security risk by exposing these elevated privileges to potentially malicious code [6][7]. Best Practices for Hardening To secure your workflows, you should: 1. Explicitly set permissions: Use the permissions key at the workflow or job level to restrict the GITHUB_TOKEN to only the necessary scopes [1][4]. It is a recommended security practice to set the default to empty (permissions: {}) and then grant only required access [9]. 2. Limit GITHUB_TOKEN scope: Use the principle of least privilege to ensure the token has only the minimum access required to perform its task [4][5]. 3. Handle pull_request_target with caution: When using pull_request_target, ensure that any code checked out from a fork is handled safely and that secrets or high-privilege tokens are not inadvertently exposed [6][7].

Citations:

Set an explicit token policy for this workflow.

This pull_request_target workflow only uses MERGE_QUEUE_TOKEN in the step that runs gh pr merge; it does not need GITHUB_TOKEN write access. Add a top-level permissions: {} block so repository or organization default permissions cannot grant unused write scopes.

Proposed fix 
+permissions: {}
+
 jobs:
   enable-auto-merge:
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/auto-queue.yml around lines 18 - 19, Update the top-level
workflow configuration in auto-queue.yml by adding an explicit permissions: {}
block. Keep the existing MERGE_QUEUE_TOKEN usage in the gh pr merge step
unchanged, ensuring the pull_request_target workflow does not inherit repository
or organization default GITHUB_TOKEN permissions.

Source: Path instructions

Loading