bug(ci): isolate metrics publication from pull-request code

Summary

The pr-feedback job checks out the pull-request head and then executes the repository-local action .github/actions/pr-metrics-comment while the job has pull-requests: write.

A contributor who can push to a same-repository pull-request branch can change that local action. The changed action then runs in the pull-request workflow with the writable GITHUB_TOKEN. This allows pull-request write operations under the workflow identity.

Fork pull requests normally receive a restricted token. That does not remove the risk for same-repository branches.

Evidence

The current default branch contains this source-to-sink path:

1. .github/workflows/ci.yml:506-519 defines the pr-feedback job with pull-requests: write.
2. .github/workflows/ci.yml:521-526 checks out the pull-request head.
3. .github/workflows/ci.yml:611-619 invokes ./.github/actions/pr-metrics-comment.
4. .github/actions/pr-metrics-comment/action.yml:42-63 runs lib/main.js through actions/github-script.
5. .github/actions/pr-metrics-comment/lib/main.js:87-120 reads pull-request data and calls upsertComment.
6. .github/actions/pr-metrics-comment/lib/comment.js:5-25 calls the GitHub API to update or create a pull-request comment.

persist-credentials: false limits checkout credential persistence. It does not remove the workflow token from the github-script context.

Impact

A modified pull-request action can use the write-capable workflow token to alter pull-request comments and any other pull-request operation allowed by the job token. This breaks the separation between untrusted pull-request code and trusted automation identity.

The issue affects same-repository pull requests. It also affects a compromised contributor account or a compromised branch that can modify the local action.

The adjacent qodana job also checks out pull-request code and has pull-request write permission. Treat that as a separate review item. Do not mark this advisory fixed only because the metrics action is moved.

Immediate containment

Remove pull-requests: write from the pull-request-controlled pr-feedback job. Use read-only permission for the computation job until the publication path is separated.

Required remediation

Split metrics computation from comment publication:

1. Run metrics computation in the untrusted pull-request workflow with a read-only token.
2. Produce a small, strict JSON result. Do not include executable content, arbitrary Markdown, links, paths, or unbounded text.
3. Upload the result as an artifact bound to the source run.
4. Add a trusted workflow_run publisher that is supplied from the default branch.
5. Make the publisher check out only the default branch. Never check out or execute pull-request code in the publisher.
6. Validate the source repository, workflow identity, event, run status, run attempt, pull-request number, base branch, head repository, head branch, head SHA, base SHA, and artifact identity.
7. Reject stale, duplicate, missing, expired, oversized, malformed, or unexpected artifacts.
8. Render and publish the comment only after all checks succeed.
9. Serialize publication for one pull request and reject results for a newer head or changed base.

Acceptance criteria

• Pull-request-controlled code cannot access a write-capable pull-request token.
• The trusted publisher executes only default-branch code.
• A same-repository pull request cannot modify the publisher implementation or its input validation.
• The publisher accepts only an artifact from the exact expected workflow run, attempt, repository, event, pull request, and commit.
• Tests cover same-repository, fork, rerun, stale-head, changed-base, missing-artifact, duplicate-artifact, malformed-artifact, oversized-artifact, and modified-local-action cases.
• The adjacent qodana write permission has a separate verified design and remediation decision.

References

• GitHub Actions secure use: https://docs.github.com/en/actions/reference/security/secure-use
• GitHub workflow events: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
• Repository security policy: https://github.com/LMLiam/Kotventure/security/policy

No patch or release change is included in this report.

Affected releases

The vulnerable workflow configuration was introduced in commit 37994ad85a95fbbc45dced7a914ce504eba9a26d, which is included in release 0.16.0. The configuration remains present on the current default branch.

This is a repository workflow vulnerability. It is not a defect in the published Kotlin library binaries. Repository maintainers must update the workflow. Consumers must not treat a dependency upgrade as a fix.

Affected version range: >= 0.16.0.

No patched version exists yet. Update this advisory after the workflow remediation is released.

Version boundary

The first affected released version is 0.16.0. Release 0.15.2 does not contain .github/actions/pr-metrics-comment.