From 7e90da05c6c5a2180b3b9d2e3433577b9fdf0170 Mon Sep 17 00:00:00 2001 From: Bryan Eastes Date: Thu, 30 Jul 2026 11:06:31 -0700 Subject: [PATCH 1/2] Updating examples and documentation to recommend pinning to the sha where codex was invoked --- README.md | 12 ++++++------ docs/security.md | 6 ++++++ 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 8f7c6c2..35ceb65 100644 --- a/README.md +++ b/README.md @@ -35,19 +35,19 @@ jobs: steps: - uses: actions/checkout@v5 with: - # Explicitly check out the PR's merge commit. - ref: refs/pull/${{ github.event.pull_request.number }}/merge + # Pin the merge commit captured by the pull_request event. + ref: ${{ github.sha }} persist-credentials: false - name: Pre-fetch base and head refs for the PR env: - PR_BASE_REF: ${{ github.event.pull_request.base.ref }} - PR_NUMBER: ${{ github.event.pull_request.number }} + PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} + PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} run: | # Pass GitHub expressions through env and quote shell expansions. git fetch --no-tags origin \ - "$PR_BASE_REF" \ - "+refs/pull/$PR_NUMBER/head" + "$PR_BASE_SHA" \ + "$PR_HEAD_SHA" # If you want Codex to build and run code, install any dependencies that # need to be downloaded before the "Run Codex" step. The recommended diff --git a/docs/security.md b/docs/security.md index 94894a7..939e19f 100644 --- a/docs/security.md +++ b/docs/security.md @@ -17,6 +17,12 @@ There is a lot of valuable context that can be used to fuel your invocation of C - **Repository instruction files**: when Codex operates on pull request-controlled content, files such as `AGENTS.md`, `AGENTS.override.md`, or configured fallback project docs from that content should be considered part of the untrusted input surface. - **Screenshots**: screenshots and other media have been known to be used as vehicles for prompt injection. +## Pin pull request revisions to the triggering event + +Pull request refs such as `refs/pull//merge`, `refs/pull//head`, and branch names can change after a maintainer approves or triggers a workflow. Check out and fetch immutable commit SHAs from the triggering event instead. For `pull_request` workflows, `github.sha` is the event's merge commit; `github.event.pull_request.head.sha` and `github.event.pull_request.base.sha` identify the corresponding head and base commits. + +Checking the triggering actor's repository permissions does not establish trust in the checked-out code. In privileged workflows such as `pull_request_target` or `issue_comment`, do not execute fork-controlled code or load fork-controlled files as trusted instructions. Pinning a SHA prevents the revision from changing; it does not make untrusted code safe. + ## Limit command permissions Use `permission-profile` to select the narrowest filesystem and network policy that still lets Codex From 020e5e784b9d989a18a64ce9f90b9a0ab3dd1b59 Mon Sep 17 00:00:00 2001 From: Bryan Eastes Date: Thu, 30 Jul 2026 11:29:58 -0700 Subject: [PATCH 2/2] One more update to security.md to remove mutable refs --- docs/security.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/security.md b/docs/security.md index 939e19f..9c9de35 100644 --- a/docs/security.md +++ b/docs/security.md @@ -51,9 +51,9 @@ Instead, pass those values through `env:` and quote the shell variables that con ```yaml - name: Safe shell usage env: - PR_BASE_REF: ${{ github.event.pull_request.base.ref }} + PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} run: | - git fetch origin "$PR_BASE_REF" + git fetch origin "$PR_BASE_SHA" ```