Skip to content

Conversation

@kiblik
Copy link
Contributor

@kiblik kiblik commented Apr 30, 2025

Disable execution of specific GHA in forks.
They would just fail, and it just generates noise.

@dryrunsecurity
Copy link

DryRun Security

This pull request focuses on enhancing GitHub Actions security by implementing repository-specific restrictions that limit workflow execution, deployment, and notifications to the main repository, thereby preventing unauthorized actions in forked repositories and improving overall access control.

💭 Unconfirmed Findings (4)
Vulnerability Workflow Repository Restrictions
Description GitHub Actions workflows were modified to add repository-specific conditions for deployment and notification workflows, ensuring that actions are only executed in the main DefectDojo repository, preventing unauthorized actions in forked repositories.
Vulnerability Deployment Limitation
Description Implemented a mechanism to prevent documentation deployment in forked repositories, enhancing security and controlling workflow execution.
Vulnerability Notification Control
Description Limited Slack PR reminder notifications to the core repository, reducing unnecessary communication and potential information leakage in forked repositories.
Vulnerability Access Control Enhancement
Description Added repository-level access control mechanisms to restrict workflow actions and improve overall security of the GitHub Actions workflows.

All finding details can be found in the DryRun Security Dashboard.

@Maffooch Maffooch added this to the 2.46.0 milestone Apr 30, 2025
Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@mtesauro mtesauro merged commit dfa5304 into DefectDojo:bugfix May 2, 2025
76 checks passed
@kiblik kiblik deleted the gha_not_in_fork branch May 2, 2025 06:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants