Skip to content

ci: keep the release token out of the push URL #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
earakely-scale merged 1 commit into from
Sep 30, 2026
Merged

ci: keep the release token out of the push URL #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion scripts/circleci_release_bump.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,16 @@ set -euo pipefail
: "${CIRCLE_PROJECT_USERNAME:?CIRCLE_PROJECT_USERNAME must be set}"
: "${CIRCLE_PROJECT_REPONAME:?CIRCLE_PROJECT_REPONAME must be set}"

REMOTE="https://x-access-token:${GH_TOKEN}@github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}.git"
REMOTE="https://x-access-token@github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}.git"
MAIN_REF="refs/remotes/release/main"
MAX_ATTEMPTS=3

git config user.name "${GH_APP_BOT_NAME}"
git config user.email "${GH_APP_BOT_EMAIL}"
# The token reaches git through a credential helper that reads it from the environment at
# push time, so it is never part of a URL that git or this script could print. The user name
# stays in the URL so CircleCI checkout's global https-to-ssh insteadOf rewrite does not match.
git config credential.helper '!f() { echo username=x-access-token; echo "password=${GH_TOKEN}"; }; f'

@greptile-apps greptile-apps Bot Sep 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 security Token can reach another host

The new credential.helper returns GH_TOKEN for any HTTPS Git host in this checkout. The bump job currently uses only GitHub, but if a later Git call uses another host, it could send that host the release token. Limit the helper to the intended host.

How this was verified: The helper returns GH_TOKEN without checking the host Git asks it to authenticate.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: scripts/circleci_release_bump.sh
Line: 27

Comment:
**Token can reach another host**

The new `credential.helper` returns `GH_TOKEN` for any HTTPS Git host in this checkout. The bump job currently uses only GitHub, but if a later Git call uses another host, it could send that host the release token. Limit the helper to the intended host.

**How this was verified:** The helper returns `GH_TOKEN` without checking the host Git asks it to authenticate.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Cursor Fix in Claude Code Fix in Codex


pip install --quiet tomlkit

Expand Down
Loading