Skip to content

Conversation

@osyniakov
Copy link
Contributor

Description

Problem

The original cbench.yml workflow used pull_request_target trigger and checked out untrusted code from pull requests, then executed it on a self-hosted runner. This is a dangerous pattern because:

  • pull_request_target runs with write permissions in the context of the base repository
  • Checking out PR code (github.event.pull_request.head.sha) allows execution of untrusted code
  • Self-hosted runners are particularly sensitive as they may have access to internal resources

Even with authorization checks, this pattern is considered dangerous by OSSF because the check itself is in the untrusted workflow file.

Solution

The CBENCH workflow has been split into two separate workflows to address OSSF Scorecard's "Dangerous Workflow" security concern. See https://scorecard.dev/viewer/?uri=github.com/quickwit-oss/quickwit

How was this PR tested?

Testing is pending due to the unavailability of the self-hosted runner and benchmarking code.

@osyniakov
Copy link
Contributor Author

@guilload could you please check this one? Not sure what the long-term plan is here since this workflow has been disabled for a while, and last successful run was a year ago

@guilload
Copy link
Member

guilload commented Nov 5, 2025

Let's just remove the bench worflow.

@osyniakov
Copy link
Contributor Author

see #5975

@osyniakov osyniakov closed this Nov 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants