zlei6/ComfyUI
1
0
Fork 0
mirror of https://github.com/Comfy-Org/ComfyUI.git synced 2026-08-05 10:00:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

ci: scope the dispatch App to cloud only

Browse Source 
An App private key is not scoped: it can mint tokens for every repo its
App is installed on, with the App's full entitlement. The owner and
repositories inputs are step arguments, not a boundary.

cloud-code-bot is entitled to cloud's production release and migration
workflows, so storing its key in this public repo would join the two
repos' trust boundaries at the weaker one. Use a single-purpose App
holding only contents:write on Comfy-Org/cloud instead -- the same
minimal scope the outgoing PAT had, without the silent expiry.
This commit is contained in:
Matt Miller
2026-07-28 14:53:22 -07:00
parent fefe6420a7
commit c7e4ddfb59
1 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
.github/workflows/tag-dispatch-cloud.yml vendored
View File

@@ -22,14 +22,18 @@ jobs:
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
with:
# cloud-code-bot is the same App the cloud receiver already runs on:
# it authored the bump PRs, so its write access there is established
# rather than assumed.
app-id: ${{ vars.CLOUD_CODE_BOT_APP_ID }}
private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }}
# Cross-repo dispatch: create-github-app-token scopes to the current
# repository by default, so the org installation must be named
# explicitly or the POST to cloud would 403.
# A single-purpose App: installed only on Comfy-Org/cloud, holding
# only contents:write. Deliberately NOT cloud-code-bot, which is also
# entitled to cloud's production release and migration workflows --
# an App private key is not scoped, so any key stored here can mint a
# token for everything its App is entitled to, on every repo it is
# installed on. The owner/repositories inputs below are arguments,
# not a security boundary. Keeping this App minimal is what makes it
# safe to hold in a public repository.
app-id: ${{ vars.CORE_TO_CLOUD_DISPATCH_APP_ID }}
private-key: ${{ secrets.CORE_TO_CLOUD_DISPATCH_PRIVATE_KEY }}
# create-github-app-token scopes to the current repository by
# default; this dispatch targets another repo.
owner: Comfy-Org
repositories: cloud