From 659f0f404ce8ee68e38ac28481627f45930eca00 Mon Sep 17 00:00:00 2001 From: MHSanaei Date: Tue, 7 Jul 2026 01:23:10 +0200 Subject: [PATCH] fix(ci): stop executing tag-checkout code in the release smoke test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL alert 99 (actions/cache-poisoning/poisonable-step): the workflow_run job runs in the default branch's cache scope, so checking out workflow_run.head_sha and executing a script from it is a cache-poisoning surface. The if-guard (event == 'push') already kept fork PRs out, but the checkout pin was never the load-bearing part of the release verification — the version argument is, since install.sh downloads that exact release binary. Run the smoke script from the default branch instead, which also matches what real users execute. --- .github/workflows/smoke.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/smoke.yml b/.github/workflows/smoke.yml index 1f5e61e91..0c18b4419 100644 --- a/.github/workflows/smoke.yml +++ b/.github/workflows/smoke.yml @@ -2,8 +2,13 @@ name: Deploy Smoke Tests # Container smoke test for the unattended (cloud-init) install path. # Runs when the install/deploy assets change on a branch push or PR, and -# again after a release-tag build finishes uploading its assets — pinned to -# that tag, so the green result verifies the release actually being shipped. +# again after a release-tag build finishes uploading its assets — passing the +# tag as an explicit version, so the green result verifies the release +# actually being shipped. That job deliberately runs the script from the +# default branch rather than checking out the tag: workflow_run executes in +# main's cache scope, so executing checked-out code there is a cache-poisoning +# surface (CodeQL actions/cache-poisoning/poisonable-step), and users pipe +# main's install.sh anyway. # Tag pushes must NOT trigger the unpinned job directly: at that moment # releases/latest still points at the previous release (#5756), and a `paths` # filter alone cannot exclude them because a brand-new tag ref has no diff @@ -58,8 +63,6 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v7 - with: - ref: ${{ github.event.workflow_run.head_sha }} - name: Pinned release install smoke test env: XUI_SMOKE_VERSION: ${{ github.event.workflow_run.head_branch }}