Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

openhands issue resolver #343

Merged
merged 4 commits into from
Nov 28, 2024
Merged

openhands issue resolver #343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1752530
openhands
zachmayer Nov 27, 2024
02ff970
add devtools
zachmayer Nov 27, 2024
49d9aa4
bump-version
zachmayer Nov 27, 2024
e318f48
date
zachmayer Nov 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/workflows/openhands-resolver.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
name: Resolve Issue with OpenHands

on:
issues:
types: [labeled]
pull_request:
types: [labeled]
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
pull_request_review:
types: [submitted]

permissions:
contents: write
pull-requests: write
issues: write

jobs:
call-openhands-resolver:
uses: All-Hands-AI/OpenHands/.github/workflows/openhands-resolver.yml@main
with:
macro: ${{ vars.OPENHANDS_MACRO || '@openhands-agent' }}
max_iterations: ${{ vars.OPENHANDS_MAX_ITER || 50 }}
secrets:
PAT_TOKEN: ${{ secrets.PAT_TOKEN }}
PAT_USERNAME: ${{ secrets.PAT_USERNAME }}
LLM_MODEL: ${{ secrets.LLM_MODEL }}
LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
Comment on lines +27 to +31
Copy link
Contributor

@coderabbitai coderabbitai bot Nov 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codebase verification

Security improvements needed for workflow secrets

Based on the verification results, several security concerns need to be addressed:

  1. The openhands-resolver.yml workflow has broad permissions (contents: write, pull-requests: write, issues: write) but lacks environment protection rules.
  2. The PAT_TOKEN and LLM_API_KEY are used without environment restrictions or rotation policies.
  3. Other workflows properly use read-all permissions, but the pkgdown job has specific contents: write permission.

Recommendations:

  • Define a protected environment for the OpenHands resolver workflow
  • Restrict the PAT_TOKEN permissions to the minimum required scope
  • Implement a secret rotation policy for LLM_API_KEY
  • Consider using OIDC federation instead of long-lived PAT tokens
🔗 Analysis chain

Review security considerations for sensitive secrets

The workflow uses several sensitive secrets. Consider the following security recommendations:

  1. Ensure PAT_TOKEN has minimal required permissions
  2. Consider adding environment protection rules for production environments
  3. Verify if LLM_API_KEY requires rotation policies

Let me gather more information about how these tokens are used across the workflows.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Check for environment protection rules

# Check if any environment protection rules exist
gh api repos/{owner}/{repo}/environments --jq '.[].protection_rules'

# Check for any existing secret rotation workflows
rg -l "GITHUB_TOKEN|PAT_TOKEN|API_KEY" .github/workflows/

Length of output: 371

Script:

#!/bin/bash
# Check the context and permissions of token usage in workflows
rg -A 5 -B 5 "GITHUB_TOKEN|PAT_TOKEN|API_KEY" .github/workflows/

# Check if there are any environment definitions
rg -l "environment:" .github/workflows/

# Check for any permissions definitions in workflows
rg -A 5 "permissions:" .github/workflows/

Length of output: 5329

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@coderabbitai What is Define a protected environment for the OpenHands resolver workflow?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zachmayer, defining a protected environment for the OpenHands resolver workflow involves setting up an environment in your GitHub repository to add additional security measures for workflows that use sensitive permissions and secrets.

By creating a protected environment, you can:

  • Require manual approvals before a job can access the environment and its secrets.
  • Restrict branch access, specifying which branches can use the environment.
  • Set up protection rules like required reviewers or wait timers.

Here's how you can set it up:

  1. Create a new environment:

    • Go to your repository's Settings > Environments.
    • Click on "New environment" and name it (e.g., openhands-production).

  2. Configure protection rules (optional but recommended):

    • Add required reviewers who must approve before the workflow can access secrets.
    • Restrict which branches can deploy to this environment.
    • Set wait timers if needed.

  3. Add secrets to the environment:

    • Instead of storing sensitive secrets in repository-level secrets, add them to your new environment.
    • This ensures that only workflows referencing this environment can access these secrets.

  4. Modify your workflow to use the environment:

    • Update your workflow file to specify the environment and remove the explicit secrets mapping since secrets will be inherited from the environment.
name: Resolve Issue with OpenHands

on:
  # your triggers here

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  call-openhands-resolver:
    environment: openhands-production  # Reference your protected environment here
    uses: All-Hands-AI/OpenHands/.github/workflows/openhands-resolver.yml@main
    with:
      macro: ${{ vars.OPENHANDS_MACRO || '@openhands-agent' }}
      max_iterations: ${{ vars.OPENHANDS_MAX_ITER || 50 }}
    # Remove the 'secrets' section; secrets are accessed from the environment

By associating your job with the openhands-production environment, GitHub Actions will enforce the protection rules you've set, enhancing the security for workflows with elevated permissions or sensitive data.

Let me know if you have any questions or need further assistance!

7 changes: 4 additions & 3 deletions DESCRIPTION
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
Package: caretEnsemble
Type: Package
Title: Ensembles of Caret Models
Version: 4.0.1
Date: 2024-08-17
Version: 4.0.2
Date: 2024-11-27
Authors@R: c(person(c("Zachary", "A."), "Deane-Mayer", role = c("aut", "cre", "cph"), email = "[email protected]"),
person(c("Jared", "E.", "Knowles"), role="ctb", email="[email protected]"),
person("Antón", "López", role="ctb", email="[email protected]")
Expand Down Expand Up @@ -35,7 +35,8 @@ Suggests:
rpart,
spelling,
testthat,
usethis
usethis,
devtools
Imports:
caret,
data.table,
Expand Down
Loading