harden: this workflow uses secrets: inherit to pass a... in...

[anupamme]

Summary

Harden input handling in workflow-templates/backup-to-gitlab.yml (flagged by semgrep).

Vulnerability

Field	Value
ID	yaml.github-actions.security.secrets-inherit.secrets-inherit
Severity	HIGH
Scanner	semgrep
Rule	yaml.github-actions.security.secrets-inherit.secrets-inherit
File	workflow-templates/backup-to-gitlab.yml:11
Assessment	Defensive hardening

Description: This workflow uses secrets: inherit to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the secrets: map, e.g. secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }.

Changes

• workflow-templates/backup-to-gitlab.yml

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security

Summary by Sourcery

Limit secrets passed to backup workflows to reduce unintended credential exposure.

Bug Fixes:

• Restrict reusable backup workflows to the specific GitLab and Gitee credentials they require instead of inheriting all repository secrets.

Enhancements:

• Harden workflow secret handling according to least-privilege principles.

[sourcery-ai]

Sorry @anupamme, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: anupamme

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

CLA Assistant Lite bot:

如果你是以企业贡献者的身份进行提交，请联系我们签署企业贡献者许可协议
If you submit as corporate contributor, please contact us to sign our Corporate Contributor License Agreement

感谢您的提交，我们非常感谢。 像许多开源项目一样，在接受您的贡献之前，我们要求您签署我们的个人贡献者许可协议。 您只需发布与以下格式相同的评论即可签署个人贡献者许可协议。
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Individual Contributor License Agreement before we can accept your contribution. You can sign the Individual Contributor License Agreement by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA.

---

_{You can retrigger this bot by commenting recheck in this Pull Request}

[deepin-ci-robot]

Hi @anupamme. Thanks for your PR. 😃

[deepin-ci-robot]

Hi @anupamme. Thanks for your PR.

I'm waiting for a linuxdeepin member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR hardens a GitHub Actions workflow template by replacing broad secrets: inherit usage with explicit, least-privilege secret mappings for two reusable workflows.

File-Level Changes

Change	Details	Files
Restrict secret propagation in the backup-to-gitlab workflow template to explicitly required tokens instead of inheriting all repository secrets.	Replace secrets: inherit for the GitLab backup job with an explicit mapping for BRIDGETOKEN using ${{ secrets.BRIDGETOKEN }}. Replace secrets: inherit for the Gitee backup job with an explicit mapping for GITEE_SYNC_TOKEN using ${{ secrets.GITEE_SYNC_TOKEN }}. Maintain existing reusable workflow references and job structure to preserve behavior while tightening secret exposure.	workflow-templates/backup-to-gitlab.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.