fix: fix ci RCE via pull_request_target (#2052)

* fix pull request ghcr 403

Author: HUAHUAI23

.github/workflows/doc-deploy.yml

@@ -0,0 +1,39 @@
+name: Deploy Documentation
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - ".github/workflows/doc-deploy.yml"
+
+env:
+  LAF_CI_DOCS_PREVIEW_PAT: ${{ secrets.LAF_CI_DOCS_PREVIEW_PAT }}
+  LAF_CI_DOCS_PREVIEW_APPID: ${{ secrets.LAF_CI_DOCS_PREVIEW_APPID }}
+  LAF_CI_DOCS_PREVIEW_API_URL: ${{ secrets.LAF_CI_DOCS_PREVIEW_API_URL }}
+
+jobs:
+  deploy-docs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Build Docs
+        uses: ./.github/actions/build-docs
+
+      - name: Setup laf-cli
+        run: npm i laf-cli -g
+
+      - name: Login laf-cli
+        run: |
+          laf user add doc -r ${{ env.LAF_CI_DOCS_PREVIEW_API_URL }}
+          laf user switch doc
+          laf login ${{ env.LAF_CI_DOCS_PREVIEW_PAT }}
+          laf app init ${{ env.LAF_CI_DOCS_PREVIEW_APPID }}
+
+      - name: Deploy to production bucket
+        run: |
+          # Deploy to production docs bucket
+          laf storage push -f production-docs docs/.vitepress/dist/

.github/workflows/doc-preview.yml

@@ -3,7 +3,7 @@ name: Laf Doc Preview
 # todo: When the requirements are mature enough, refactor using TypeScript, create a generic GitHub Action, and make it available to users.
 
 on:
-  pull_request_target:
+  pull_request:
     branches: [main]
     types: [opened, synchronize, reopened, closed]
     paths:
@@ -21,91 +21,19 @@ env:
 
 jobs:
   create-or-update-doc-preview:
-    if: github.event_name == 'pull_request_target' && github.event.action != 'closed'
+    if: github.event_name == 'pull_request' && github.event.action != 'closed'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
         with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
           fetch-depth: 0
 
       - name: Build Docs
         uses: ./.github/actions/build-docs
 
-      - name: Setup laf-cli
-        run: npm i laf-cli -g
-
-      - name: Login laf-cli
-        run: |
-          laf user add doc -r ${{ env.LAF_CI_DOCS_PREVIEW_API_URL }}
-          laf user switch doc
-          laf login ${{ env.LAF_CI_DOCS_PREVIEW_PAT }}
-          laf app init ${{ env.LAF_CI_DOCS_PREVIEW_APPID }}
-
-      - name: Check if bucket exists
-        id: check-bucket
-        run: |
-          output=$(laf storage list)
-
-          # Check if the output contains the desired text
-          if echo "$output" | grep -q ${{ env.BUCKET_SHORT_NAME }}; then
-            echo "BUCKET_EXISTS=true" >> $GITHUB_OUTPUT
-          else
-            echo "BUCKET_EXISTS=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Create bucket and create website
-        if: steps.check-bucket.outputs.BUCKET_EXISTS == 'false'
-        id: create-bucket-and-website
-        run: |
-          laf storage create ${{ env.BUCKET_SHORT_NAME }} -p readonly
-          output=$(laf website create ${{ env.BUCKET_SHORT_NAME }})
-          last_line=$(echo "$output" | tail -n 1)
-          echo "website_url_message=$last_line" >> $GITHUB_OUTPUT
-
-      - name: Deploy to laf
-        run: |
-          laf storage push -f ${{ env.BUCKET_SHORT_NAME }} docs/.vitepress/dist/
-
-      - uses: mshick/add-pr-comment@v2
-        if: steps.check-bucket.outputs.BUCKET_EXISTS == 'false'
-        with:
-          message: |
-            Laf Doc Preview:
-            ${{ steps.create-bucket-and-website.outputs.website_url_message }}
-
-  delete-doc-preview:
-    if: github.event_name == 'pull_request_target' && github.event.action == 'closed'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Setup laf-cli
-        run: npm i laf-cli -g
-
-      - name: Login laf-cli
-        run: |
-          laf user add doc -r ${{ env.LAF_CI_DOCS_PREVIEW_API_URL }}
-          laf user switch doc
-          laf login ${{ env.LAF_CI_DOCS_PREVIEW_PAT }}
-          laf app init ${{ env.LAF_CI_DOCS_PREVIEW_APPID }}
-
-      - name: Check if bucket exists
-        id: check-bucket
-        run: |
-          output=$(laf storage list)
-
-          # Check if the output contains the desired text
-          if echo "$output" | grep -q ${{ env.BUCKET_SHORT_NAME }}; then
-            echo "BUCKET_EXISTS=true" >> $GITHUB_OUTPUT
-          else
-            echo "BUCKET_EXISTS=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Delete bucket
-        if: steps.check-bucket.outputs.BUCKET_EXISTS == 'true'
-        id: delete-bucket
+      - name: PR build summary
         run: |
-          laf website del ${{ env.BUCKET_SHORT_NAME }}
-          laf storage del ${{ env.BUCKET_SHORT_NAME }}
+          echo "📖 Documentation built successfully for PR #${{ github.event.pull_request.number }}"
+          echo "⚠️  Doc preview deployment is disabled for security reasons"
+          echo "🚀 Docs will be deployed automatically when this PR is merged"
+          echo "📋 Build completed at $(date)"

.github/workflows/dockerize-runtime-exporter.yml

@@ -2,7 +2,7 @@ name: dockerize-runtime-exporter
 
 on:
   workflow_dispatch:
-  pull_request_target:
+  pull_request:
     branches: [main]
     types: [opened, synchronize, reopened]
     paths:
@@ -11,8 +11,7 @@ on:
       - "!**/*.md"
       - "!services/runtime-exporter/package-lock.json"
   push:
-    branches:
-      - main
+    branches: [main]
     paths:
       - "services/runtime-exporter/**"
       - ".github/workflows/dockerize-runtime-exporter.yml"
@@ -35,35 +34,41 @@ jobs:
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
+
+      - name: Cache node modules
+        id: cache-node-modules
+        uses: actions/cache@v3
+        with:
+          path: services/runtime-exporter/node_modules
+          key: ${{ runner.os }}-node-${{ hashFiles('services/runtime-exporter/package-lock.json') }}
 
       - name: Use Node
         uses: actions/setup-node@v3
         with:
-          node-version: 20.x
+          node-version: 18.x
 
       - name: Install Package
         working-directory: services/runtime-exporter
-        run: npm cache clean --force && npm install
+        if: steps.cache-node-modules.outputs.cache-hit != 'true'
+        run: npm ci
 
-      - name: Build Packages
+      - name: Build runtime-exporter
         working-directory: services/runtime-exporter
         run: npm run build
 
-      - name: Docker meta
+      - name: Docker meta (for push events only)
         id: meta
+        if: github.event_name != 'pull_request'
         uses: docker/metadata-action@v4
         with:
           images: |
-            ghcr.io/${{ github.repository_owner }}/runtime-exporter
-            docker.io/${{ secrets.DOCKER_USERNAME }}/runtime-exporter
+            ghcr.io/${{ github.repository_owner }}/laf-runtime-exporter
+            docker.io/${{ secrets.DOCKER_USERNAME }}/laf-runtime-exporter
           # https://github.com/docker/metadata-action#typesemver
           tags: |
-            type=ref,event=pr
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') && github.event_name != 'pull_request_target' }}
-            type=sha,format=short,enable=${{ github.ref == format('refs/heads/{0}', 'main') && github.event_name != 'pull_request_target' }}
-            type=raw,value={{branch}}-{{sha}},enable=${{ github.ref != format('refs/heads/{0}', 'main') && !startsWith(github.ref, 'refs/tags/') && github.event_name != 'pull_request_target' }}
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+            type=sha,format=short,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+            type=raw,value={{branch}}-{{sha}},enable=${{ github.ref != format('refs/heads/{0}', 'main') && !startsWith(github.ref, 'refs/tags/') }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
@@ -72,12 +77,14 @@ jobs:
         uses: docker/setup-buildx-action@v2
 
       - name: Login to DockerHub
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to Github Container Hub
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
@@ -90,27 +97,22 @@ jobs:
         with:
           context: ./services/runtime-exporter
           file: ./services/runtime-exporter/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ github.event_name != 'pull_request' && steps.meta.outputs.tags || 'laf-runtime-exporter:pr-build' }}
+          labels: ${{ github.event_name != 'pull_request' && steps.meta.outputs.labels || '' }}
           platforms: linux/amd64, linux/arm64
 
-      - name: Comment docker image tags to PR
-        if: github.event_name == 'pull_request_target'
-        uses: mshick/add-pr-comment@v2
-        with:
-          message-id: "dockerize-runtime-exporter"
-          message: |
-            **:boom: laf runtime exporter image built successfully for pr ${{ github.event.pull_request.number }}**
-            ```
-            ${{ steps.meta.outputs.tags }}
-            ```
-            digest: `${{ steps.docker-build.outputs.digest }}`
+      - name: PR build summary
+        if: github.event_name == 'pull_request'
+        run: |
+          echo "✅ Docker image built successfully for PR #${{ github.event.pull_request.number }}"
+          echo "ℹ️  Image not pushed to registry (security measure)"
+          echo "📋 Build completed at $(date)"
 
   trigger-workflow-build-cluster-image:
     needs: [dockerize-runtime-exporter]
+    if: github.ref == format('refs/heads/{0}', 'main') && github.event_name != 'pull_request'
     runs-on: ubuntu-latest
-    if: github.ref == format('refs/heads/{0}', 'main') && github.event_name != 'pull_request_target'
     steps:
       - name: trigger cluster image workflow
         uses: peter-evans/repository-dispatch@v2