Restrict server-edition deploy environment to main branch
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 74/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- gcp, github-actions, terraform
- Domain
- cloud, infrastructure, security
Research direction
Start in terraform/gcloud_auth.tf by locating the GitHub OIDC workload identity pool provider and its deploy attribute condition. Review whether release branches need deploy access, then validate the Terraform configuration; done means non-main branch workflows cannot authenticate to the deploy environment unless an explicitly approved branch policy allows them.
Written by the indexing model from the issue text.
Description
Problem
The GitHub OIDC workload identity pool provider in terraform/gcloud_auth.tf validates repository_owner and environment claims, but does not restrict by branch. Because deploy permissions are bound to attribute.repository/fullstaq-ruby/server-edition, workflows from non-main branches in fullstaq-ruby/server-edition can potentially authenticate if they run in the deploy environment.
Proposed Change
Add a ref restriction to the deploy pool's attribute condition:
attribute_condition = "assertion.repository_owner == 'fullstaq-ruby' && assertion.environment == 'deploy' && assertion.ref == 'refs/heads/main'"
Considerations
Review whether non-main branches ever need deploy access (e.g., release branches). If so, use a prefix match instead of exact match.
- Dominant language
- HCL
- Stars
- 10
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from fullstaq-ruby/infra
-
Difficulty 2/5 1-3 hours Newbie friendliness 50/100
fullstaq-ruby/infra#58 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
fullstaq-ruby/infra#56 · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 76/100
fullstaq-ruby/infra#55 ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
fullstaq-ruby/infra#53 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
fullstaq-ruby/infra#49 ·
All issues in fullstaq-ruby/infra
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
bug needs-triage service/elbv2
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
hashicorp/terraform-provider-aws#50100 · 1 comment ·