gravitational / gravitational/shared-workflows
Approval service rejections can be bypassed by retrying denied workflow runs
Open
Nobody has claimed this yet.
bug
security
- Dominant language
- Go
- Stars
- 7
- Forks
- 4
- Avg merge
- 19h 53m
- Merged PRs (30d)
- 5
Description
GHA workflows denied by the approval service can be retried, and will eventually succeed, bypassing the service entirely.
Example workflow run: https://github.com/gravitational/teleport.e/actions/runs/18791263690
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the linked workflow run and trace how the approval service handles denied runs and retries. Inspect the shared workflow entry points involved in approval and retry behavior. Done means a denied workflow cannot later succeed by retrying without going through the approval service.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100