fix(security): make same-repo gate on claude-auto-fix-ci.yml explicit

[aaronjmars]

Summary

.github/workflows/claude-auto-fix-ci.yml runs on workflow_run after the public-input CI workflow completes, then checks out PR code (ref: github.event.workflow_run.head_branch) and runs bun install + Claude with Bash(*) in a context that has access to repository secrets (CLAUDE_CODE_OAUTH_TOKEN, SUPERMEMORY_API_KEY, write-scoped GITHUB_TOKEN). This is the canonical "pwn request" pattern documented by GitHub Security Lab — checking out untrusted code in a privileged workflow.

The existing gate github.event.workflow_run.pull_requests[0] happens to be empty for fork PRs today (documented GitHub behavior), but the security boundary is implicit and brittle to future GitHub behavior changes. This PR makes the boundary explicit.

Impact

In the current implementation, with a workflow_run trigger plus untrusted-PR checkout plus bun install, a PR whose package manifest carries a postinstall script would execute that script in the privileged workflow context. Today the implicit guard prevents that for fork PRs; the addition here makes the same guarantee explicit and surface-visible so the security intent doesn't depend on a documented-but-non-contractual GitHub behavior.

Residual risk (out of scope for this PR): the workflow still trusts collaborators who can push branches to this repository. That trust boundary is intentional — auto-fix has to be able to read and modify PR code by design — but is worth documenting separately in a SECURITY.md or contributor guide.

Location

.github/workflows/claude-auto-fix-ci.yml:18-31

Fix

Adds an explicit head-repository identity check to the job-level if: condition:

github.event.workflow_run.head_repository.full_name == github.event.workflow_run.repository.full_name

This means the job only runs when the failing CI run originated from a branch in this repository, not a fork. Same behavior as today via the implicit pull_requests[0] guard, but encoded as a first-class gate that any future workflow editor will see and not accidentally remove.

A multi-line YAML comment above the condition documents the threat model and links to the GitHub Security Lab article on pwn-request mitigation, so the next person to touch this file understands why the gate exists.

Detected by

Aeon + Semgrep p/security-audit (rule yaml.github-actions.security.workflow-run-target-code-checkout).

• Severity: medium (defense-in-depth — the implicit pull_requests[0] gate covers the most exploitable fork-PR case today, but the explicit gate removes the reliance on undocumented behavior)
• CWE-913 (Improper Control of Dynamically-Managed Code Resources)

Verification

python3 -c "import yaml; yaml.safe_load(open('claude-auto-fix-ci.yml'))" parses cleanly. The if: condition still triggers on the intended same-repo failing-PR case (verified by re-reading the parsed condition in the YAML AST). All steps, permissions, and secrets references unchanged.

---

Filed by Aeon.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​16.0.3
	@​mastra/​core@​1.9.0
	@​dnd-kit/​utilities@​3.2.2
	@​lobbyside/​react@​0.2.0
	@​better-fetch/​fetch@​1.1.21
	@​floating-ui/​react@​0.27.19
	@​dnd-kit/​core@​6.3.1
	@​dnd-kit/​sortable@​10.0.0
	@​dnd-kit/​modifiers@​9.0.0
	@​google/​generative-ai@​0.24.1
	@​types/​node@​18.19.130 ⏵ 20.19.35	+1		+1
	vite@​6.4.1
	react@​19.2.4 ⏵ 19.2.2
	react@​19.2.4 ⏵ 19.2.0
	@​pixi/​react@​8.0.5
	@​hono/​zod-validator@​0.7.6
	@​opennextjs/​cloudflare@​1.17.1
	@​modelcontextprotocol/​sdk@​1.27.1
	@​modelcontextprotocol/​ext-apps@​1.1.2
	react-dom@​19.2.2
	react-dom@​19.2.0
	@​cloudflare/​ai-chat@​0.0.7
	@​biomejs/​biome@​2.4.6
	@​google/​genai@​1.44.0
	@​cloudflare/​workers-oauth-provider@​0.2.4
	agents@​0.3.10

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: Next.js is vulnerable to RCE in React flight protocol CVE: GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol (CRITICAL) Affected versions: >= 14.3.0-canary.77 < 15.0.5; >= 15.1.0-canary.0 < 15.1.9; >= 15.2.0-canary.0 < 15.2.6; >= 15.3.0-canary.0 < 15.3.6; >= 15.4.0-canary.0 < 15.4.8; >= 15.5.0-canary.0 < 15.5.7; >= 16.0.0-canary.0 < 16.0.7 Patched version: 16.0.7 From: apps/memory-graph-playground/package.json → npm/next@16.0.3 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report