Add functionality for allow self-hosted runner to protect workflow file and allow only execution only for collaborators for PRS

[MalloZup]

Description:

Hi all,
first of all I really like the github action runner and self-hosted runner.

It has however an issue with working for pull-request workflows.

I think the runner should have a way to be configurable to run only on Pull-requests from collaborator of X org or Repo.
The problem to be solved is to protect the github-workflow file and don't be changed by any arbitrary PR ( so there is no output redirection or other code executed)
it is a recurring topic in some forums, but there is no solution or any issue about this afaik. let me know, and ping me for any info .

best

[TingluoHuang]

@MalloZup sounds like some policy feature we can add on the service side even before sending the job to the runner.

@chrispat for feedback.

[MalloZup]

@TingluoHuang that could be awesome thx!

[plfiorini]

This would likely solve the security concerns of self-hosted runners

[MalloZup]

yes this is the goal 🌞

[chrispat]

@MalloZup I don't believe this makes sense as a runner feature but rather something that is enforced on the GitHub.com side. There are scenarios where customers want this type of feature for hosted runners and not just self-hosted.

[MalloZup]

@chrispat yes I agree with you partially.
I believe globally it make sense to have it on GIthub.com side.
However I think that also the runner can still have it own way to setup this.

Is like when developing a CLI command line.
Let assume the Github.com is our configuration file, from which the user setup option for our CLI. ( the CLI is the runner)

If an user use the CLI command line arguments, this overwrite the configuration file input (github.com).

In any ways, even if it you will implement globally you will need to instruct and implement the mechanism on the runner, afaik and correct me if I'm wrong.

Do you have a link where there is the Github.com UI source code where I can open such issue for the global part?

I think we could continue with this issue implementation on the runner side, since lot of user are depending on this to have a pragmatic/secure CI.

Personally the UI github.com implementation, from my perspective is the last part and imho it will take much more to implementation time then implementing such feature on the runner ( which is just a partial feature).
Having such feature on the runner side, is just a step imho that it will need to be done also if the options are passed from github.

Thanks for your answer and time ping me for any info or I can help.
🌻

[chrispat]

@MalloZup Given the architecture of Actions the runner is not the best place to implement this feature. The runner is a relatively small part of the overall Action system and is designed to be a remote execution daemon for the Actions workflow.

In the case of GitHub hosted runners, self-hosted runners or runners that spin up on demand you waste a lot of time and money by spinning up a runner on a VM or in a container to make a simply policy check that should be done by the GitHub Actions workflow engine.

[MalloZup]

@chrispat do you know where I could open this issue for the github workflow engine?

Thank you in advance

[iagomls]

That feature would be extremely valuable to our team. 👍

We use Github Actions Runner labels to decide which infrastructure will be responsible for processing the job, some servers have more permissions than others. Here are some examples:

• There are runners which are responsible for provisioning resources using Terraform. It's possible to do literally anything inside of them.
• Some runners are responsible for deploying code to our stage environment.
• Some runners are responsible for deploying code to our prod environment.
• Other runners are responsible for only running tests using some cloud resources (storage, messaging, etc).

If a developer can change the labels and the jobs that are executed, all these security policies are thrown away. It would be possible to simply change the label of a test workflow to use a terraform runner and do anything there - delete a database, get access to any server or obtain any kind of sensitive data, like database passwords or private API keys. 💀