Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Safe Outputs Conformance] SEC-005: Cross-repo target-repo field flagged without allowlist check

Open Beginner friendly
  • Is something wrong?
#71,058 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
67/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
github-actions, shell
Domain
ci-cd, devtools, security

Research direction

Read scripts/check-safe-outputs-conformance.sh, especially check_cross_repo, and inspect the targetRepo mappings in actions/setup/js/unified_session_payload.cjs and actions/setup/js/unified_session_render.cjs. Confirm these files only pass through or display metadata, then add the documented SEC-005 exemptions near the mappings. Run bash scripts/check-safe-outputs-conformance.sh and confirm both files pass.

Written by the indexing model from the issue text.

Description

automated conformance safe-outputs security
Conformance Check Failure

Check ID: SEC-005
Severity: HIGH
Category: Security

Problem Description

The conformance checker flags two files for supporting a target-repo-shaped field without a visible allowlist validation call:

  • actions/setup/js/unified_session_payload.cjs (line ~453): maps targetRepo/target_repo into the unified session payload field extraction table.
  • actions/setup/js/unified_session_render.cjs (line ~276): includes targetRepo in a list of fields rendered into a human-readable session log line.

Both usages are read-only: they copy an already-resolved targetRepo value from session metadata into an observability payload or log line for display. Neither file makes a GitHub API call against a different repository, so SEC-005s allowlist requirement (allowed.*[Rr]epos, validateTargetRepo, checkAllowedRepo) does not apply to them the way it does to a true cross-repo write handler.

Affected Components
  • Files: actions/setup/js/unified_session_payload.cjs, actions/setup/js/unified_session_render.cjs
  • Check: scripts/check-safe-outputs-conformance.sh function check_cross_repo (SEC-005)
<b>Current vs Expected Behavior</b>
Current Behavior

The SEC-005 regex (\btarget-repo\b|\btargetRepo\b|\btarget_repo\b) matches any file that merely references a targetRepo identifier, including pure display/metadata-mapping code, and then requires an allowlist-check pattern in that same file or logs a HIGH failure.

Expected Behavior

SEC-005 is intended to catch handlers that use target-repo to perform a cross-repository GitHub API write without validating against allowed-repos. Pure metadata pass-through/rendering code that never calls the GitHub API should not trip this check. The script already supports a documented exemption via an @safe-outputs-exempt SEC-005 annotation for exactly this situation.

Remediation Steps
  1. Confirm unified_session_payload.cjs and unified_session_render.cjs never pass targetRepo to an octokit call or any cross-repo write path (only read/display it).
  2. If confirmed, add a documented exemption comment (// @safe-outputs-exempt SEC-005: <reason>) near the targetRepo field mapping in both files, explaining that the field is display/telemetry-only metadata, not a cross-repo write target.
  3. If either file is later changed to perform an actual cross-repo API call using this field, remove the exemption and add a real allowlist check at that call site instead.
Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

SEC-005 should report PASS for both files.

References
  • Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
  • Conformance Checker: scripts/check-safe-outputs-conformance.sh
  • Run: §39729823556
  • Date: 2026-10-22

Generated by ✅ Daily Safe Outputs Conformance Checker · claude · agent · 132.9 AIC · ⌖ 0.552 AIC · ⊞ 5.4K · ◷

  • expires on Oct 22, 2026, 9:54 PM UTC-08:00
Dominant language
Go
Stars
5.4k
Forks
596
Avg merge
3h 41m
Merged PRs (30d)
829

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw

All issues in github/gh-aw

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.