backport: add CMake build system alongside Autotools #7481
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| name: Build source (CMake) | ||
|
|
||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| build-target: | ||
| description: "Target name as defined by inputs.sh" | ||
| required: true | ||
| type: string | ||
| container-path: | ||
| description: "Path to built container at registry" | ||
| required: true | ||
| type: string | ||
| depends-key: | ||
| description: "Key needed to access cached depends" | ||
| required: true | ||
| type: string | ||
| depends-host: | ||
| description: "Host triplet from depends build" | ||
| required: true | ||
| type: string | ||
| depends-dep-opts: | ||
| description: "DEP_OPTS used to build depends" | ||
| required: false | ||
| type: string | ||
| default: "" | ||
| runs-on: | ||
| description: "Runner label to use (e.g., ubuntu-24.04 or ubuntu-24.04-arm)" | ||
| required: true | ||
| type: string | ||
|
|
||
| # Builds the tree with CMake on top of the depends prefix produced for the | ||
| # Autotools jobs, which is what makes this a full-stack check: depends emits | ||
| # toolchain.cmake, CMake consumes it, and the unit tests run against the | ||
| # result, followed by a short functional smoke list. The full functional suite | ||
| # stays with the Autotools jobs, so this job does not bundle artifacts. | ||
| jobs: | ||
| build-src-cmake: | ||
| name: Build source (CMake) | ||
| runs-on: ${{ inputs.runs-on }} | ||
| container: | ||
| image: ${{ inputs.container-path }} | ||
| options: --user root | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| fetch-depth: 50 | ||
|
Comment on lines
+45
to
+49
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files .github/workflows || true
echo "== target workflow excerpt =="
if [ -f .github/workflows/build-src-cmake.yml ]; then
cat -n .github/workflows/build-src-cmake.yml
fi
echo "== all pull_request_target occurrences =="
rg -n "pull_request_target|pull_request\b|permissions:|GITHUB_TOKEN|checkout|permissions =" .github || true
echo "== changed workflow status =="
git diff -- .github/workflows/build-src-cmake.yml || trueRepository: dashpay/dash Length of output: 11666 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== build.yml relevant excerpt =="
cat -n .github/workflows/build.yml | sed -n '1,120p'
echo "== build-src-cmake workflow_call references =="
rg -n "build-src-cmake|build_src_cmake|matrix\.sh|workflow_call|event_name|head\.sha|permissions:" .github/workflows/build.yml .github/workflows/build-src-cmake.ymlRepository: dashpay/dash Length of output: 7034 🌐 Web query:
💡 Result: The Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== build.yml build-src-cmatrix inputs =="
cat -n .github/workflows/build.yml | sed -n '210,245p'
echo "== build-container uses workflow_call and checkout refs =="
cat -n .github/workflows/build-container.yml | sed -n '1,80p'
echo "== build-depends workflow_call and checkout refs =="
cat -n .github/workflows/build-depends.yml | sed -n '1,130p'
echo "== cache-depends-sources workflow_call and checkout refs =="
cat -n .github/workflows/cache-depends-sources.yml | sed -n '1,80p'Repository: dashpay/dash Length of output: 12296 🌐 Web query:
💡 Result: The pull_request_target event is a powerful trigger in GitHub Actions that runs workflows in the context of the base repository's default branch, granting them elevated trust, including access to organization/repository secrets and a write-capable GITHUB_TOKEN [1][2][3]. This trigger was designed to allow automation (like labeling or triage) on pull requests from forks, where standard pull_request events would be restricted [1][4]. Security Risks and Mechanics The primary security risk, often called a "pwn request," occurs when a workflow uses pull_request_target and then checks out the untrusted head commit of a pull request from a fork [5][2]. If that workflow subsequently executes any code from that checkout (e.g., running tests, build scripts, or Makefiles), an attacker can execute arbitrary commands with the base repository's secrets and elevated permissions [2][6]. Mitigation and Recent Changes 1. Automatic Protection: As of June 2026, actions/checkout v7 automatically refuses to fetch fork pull request code in pull_request_target workflows to prevent these vulnerabilities [5]. 2. Opt-Out: If a workflow genuinely requires checking out fork code with elevated trust, authors must explicitly add allow-unsafe-pr-checkout: true to the actions/checkout step [1][5]. This is an intentional hurdle meant to highlight the security risk during code review [5]. 3. Permissions: Setting permissions: contents: read at the job level is a recommended best practice to apply the principle of least privilege [7][8]. However, security researchers warn that this is a partial mitigation [9]. Permissions flags restrict the GITHUB_TOKEN but do not isolate the runner environment [9]. Features such as actions/cache and in-memory OIDC tokens can potentially be exploited by malicious code running on the same runner, regardless of the job's defined permissions [9]. 4. Context Execution: Because pull_request_target workflows run from the default branch, the workflow file itself is trusted [1][6]. The vulnerability only arises if the workflow fetches and executes external, unreviewed code [6]. Recommendation To secure these workflows: - Avoid executing code from a pull request head commit [2]. - If you only need to inspect changes (e.g., labeling), use the GitHub API to read PR data rather than checking out the source code [2]. - If you must use pull_request_target, explicitly define least-privilege permissions [1][7]. - Treat the entire runner environment as a trust boundary, not just the permissions on the GITHUB_TOKEN [9]. Citations:
Do not execute the PR head from this build workflow. When triggered by 🧰 Tools🪛 zizmor (1.26.1)[warning] 45-49: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI AgentsSource: Linters/SAST tools There was a problem hiding this comment. The current checkout-v6.1 default prevents the fork-head checkout before PR code executes, so this is not a presently reachable pwn-request path. It is still a blocker because fork coverage is broken; match Dash commit There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== Current CMake workflow checkout step =="
sed -n '40,58p' .github/workflows/build-src-cmake.yml
echo "== Referenced precedent commit, relevant workflow changes =="
git show --format=fuller --no-ext-diff --unified=12 ba143fe163a -- .github/workflows 2>/dev/null || \
echo "Referenced commit is unavailable in this checkout."Length of output: 1109
✏️ Learnings added
|
||
|
|
||
| - name: Initial setup | ||
| run: | | ||
| git config --global --add safe.directory "$PWD" | ||
| shell: bash | ||
|
|
||
| - name: Restore depends cache | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: depends/built/${{ inputs.depends-host }} | ||
| key: ${{ inputs.depends-key }} | ||
| fail-on-cache-miss: true | ||
|
|
||
| - name: Rebuild depends prefix | ||
| run: | | ||
| # Use the HOST and DEP_OPTS from the depends build, not this build-target | ||
| # This ensures the build_id matches the cached packages, and it is what | ||
| # writes depends/${HOST}/toolchain.cmake. | ||
| make -j$(nproc) -C depends HOST="${{ inputs.depends-host }}" ${{ inputs.depends-dep-opts }} | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| shell: bash | ||
|
|
||
| - name: Restore ccache cache | ||
| uses: actions/cache/restore@v5 | ||
| with: | ||
| path: | | ||
| /cache/ccache | ||
| key: ccache-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-${{ github.sha }} | ||
| restore-keys: | | ||
| ccache-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}- | ||
|
|
||
| - name: Build source | ||
| run: | | ||
| CCACHE_MAXSIZE="600M" | ||
| CACHE_DIR="/cache" | ||
| mkdir /output | ||
| BASE_OUTDIR="/output" | ||
| BUILD_TARGET="${{ inputs.build-target }}" | ||
| source ./ci/dash/matrix.sh | ||
| ./ci/dash/build_src_cmake.sh | ||
| ccache -X 9 | ||
| ccache -c | ||
| du -hd0 "${BASE_OUTDIR}" | ||
| shell: bash | ||
|
|
||
| - name: Save ccache cache | ||
| if: | | ||
| github.event_name == 'push' && | ||
| github.ref_name == github.event.repository.default_branch | ||
| uses: actions/cache/save@v5 | ||
| with: | ||
| path: | | ||
| /cache/ccache | ||
| key: ccache-${{ hashFiles('contrib/containers/ci/ci.Dockerfile', 'depends/packages/*') }}-${{ inputs.build-target }}-${{ github.sha }} | ||
|
|
||
| - name: Run unit tests | ||
| run: | | ||
| BUILD_TARGET="${{ inputs.build-target }}" | ||
| source ./ci/dash/matrix.sh | ||
| ./ci/dash/test_unittests_cmake.sh | ||
| shell: bash | ||
|
|
||
| - name: Run functional smoke tests | ||
| run: | | ||
| BUILD_TARGET="${{ inputs.build-target }}" | ||
| source ./ci/dash/matrix.sh | ||
| ./ci/dash/test_integrationtests_cmake.sh | ||
| shell: bash | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,6 +3,11 @@ | |
| todo.txt | ||
| reset-files.bash | ||
|
|
||
| # Build subdirectories. | ||
| /*build* | ||
| !/build-aux | ||
| !/build_msvc | ||
|
|
||
| *.tar.gz | ||
|
|
||
| *.exe | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.