One Stolen Token Should Not Ship Your App: A Two-Person Release Gate in GitHub Actions
One Stolen Token Should Not Ship Your App An attacker got hold of one admin's access token. Within minutes they had pushed a workflow file into every repository in the organisation, each one tailored to that repo, each one written to read the repo's secrets and send them out. We contained it. Tokens revoked, secrets rotated, signatures enforced. I've written about that part separately. This post…
A stolen access token was used by an attacker to push harmful code into every repository of the organization, compromising sensitive secrets. The incident led to the creation of a two-person release gate in GitHub Actions, which ensures that a merge is not the same as a release. This gate requires a merge request from one person and approval from a different, named person before the app can be released to users.
The design includes three workflows: Request, Approve, and Publish. The Request workflow builds nothing and merely writes a JSON file into a release-requests/ folder on a new branch, then opens a pull request into a dedicated release-gate branch. The Approve workflow checks certain conditions before approving the release, and the Publish workflow is the only one that interacts with signing keys and store credentials.
The request must be authored by the bot to prevent self-approval, and the hard-coded approver list ensures that only authorized individuals can release the app. Four bugs were discovered through testing, including issues with finding the reusable workflow, permissions, file selection, and handling failed publishes. These measures make it difficult for attackers to exploit the system and ensure that code is properly reviewed and approved before being released to the public.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.