Cole Murray 102a864d43 fix(security): prevent arbitrary code execution in CI workflow ... SECURITY FIX: The previous CI workflow was vulnerable to arbitrary code execution from fork PRs due to using `pull_request_target` with checkout of untrusted PR code. Attack vector: - Attacker forks repo and adds malicious node_modules/.bin/markdownlint-cli - Opens PR to trigger CI workflow - npx executes attacker's script with repository write permissions - Attacker can exfiltrate credentials, comment on PRs, or push code Fix: - Split workflow into two separate files - ci.yml: Uses pull_request_target for commenting (no code checkout) - lint-markdown.yml: Uses pull_request for linting (safe to checkout) The pull_request trigger runs fork PRs with read-only permissions and no access to repository secrets, making it safe to checkout and execute PR code. Additional improvements: - Updated actions to latest versions (checkout@v4, github-script@v7, paths-filter@v3) - Pin markdownlint-cli version to prevent supply chain attacks - Added security comments explaining the rationale Reference: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/		2026-01-12 23:10:48 -08:00
..
ISSUE_TEMPLATE	release: 0.0.77	2026-01-03 07:53:24 +08:00
workflows	fix(security): prevent arbitrary code execution in CI workflow	2026-01-12 23:10:48 -08:00
dependabot.yml	Initial commit of eigent-main	2025-08-12 01:16:39 +02:00
PULL_REQUEST_TEMPLATE.md	Initial commit of eigent-main	2025-08-12 01:16:39 +02:00