konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests Packages Projects Releases 1 Wiki Activity

[security][high] CI: tofu plan runs on push to any branch with all provider secrets; netbird-server deploy missing branch gate #196

New Issue
Closed
opened 2026-07-14 09:47:37 +00:00 by claude-bot · 1 comment
claude-bot commented 2026-07-14 09:47:37 +00:00
Member
Copy Link
Copy Source

Finding

  1. .woodpecker/deploy-infrastructure.yml plan step triggers on event: push with a path filter but NO branch: master restriction, mounting proxmox/hetzner/unifi secrets. tofu plan evaluates provider/data-source code, so a malicious .tf on a feature branch (e.g. an http/external data source) can exfiltrate secrets pre-merge. (apply is correctly gated to manual + TOFU_APPLY.)
  2. .woodpecker/deploy-netbird-server.yml is missing the 'branch: master' gate that its siblings deploy-netbird-proxy.yml and deploy-woodpecker-agent.yml have — a push to any branch touching ansible/roles/netbird-server/** runs a real ansible deploy with SSH key + vault pass + proxmox token.

Verified

Trigger blocks + env from_secret lists in the named files; sibling pipelines have branch: master, deploy-netbird-server does not.

Fix

Add branch: master to the plan trigger (or restrict secrets to master), and add the missing branch: master gate to deploy-netbird-server.yml.

Automated security review 2026-07-14. Verified in .woodpecker/.

## Finding 1. .woodpecker/deploy-infrastructure.yml plan step triggers on event: push with a path filter but NO branch: master restriction, mounting proxmox/hetzner/unifi secrets. tofu plan evaluates provider/data-source code, so a malicious .tf on a feature branch (e.g. an http/external data source) can exfiltrate secrets pre-merge. (apply is correctly gated to manual + TOFU_APPLY.) 2. .woodpecker/deploy-netbird-server.yml is missing the 'branch: master' gate that its siblings deploy-netbird-proxy.yml and deploy-woodpecker-agent.yml have — a push to any branch touching ansible/roles/netbird-server/** runs a real ansible deploy with SSH key + vault pass + proxmox token. ## Verified Trigger blocks + env from_secret lists in the named files; sibling pipelines have branch: master, deploy-netbird-server does not. ## Fix Add branch: master to the plan trigger (or restrict secrets to master), and add the missing branch: master gate to deploy-netbird-server.yml. --- _Automated security review 2026-07-14. Verified in .woodpecker/._
claude-bot commented 2026-07-14 10:05:22 +00:00
Author
Member
Copy Link
Copy Source

Verified against origin/master; both findings confirmed (plan trigger lacked branch: master gate, deploy-netbird-server.yml lacked the branch: master gate its siblings have). Fixed in PR #215 (branch fix/issue-196): added branch: master to the push trigger in deploy-infrastructure.yml (plan step) and deploy-netbird-server.yml, matching the pattern already used by deploy-netbird-proxy.yml and deploy-woodpecker-agent.yml. gitea_admin/homelab#215

Verified against origin/master; both findings confirmed (plan trigger lacked branch: master gate, deploy-netbird-server.yml lacked the branch: master gate its siblings have). Fixed in PR #215 (branch fix/issue-196): added branch: master to the push trigger in deploy-infrastructure.yml (plan step) and deploy-netbird-server.yml, matching the pattern already used by deploy-netbird-proxy.yml and deploy-woodpecker-agent.yml. https://gitea.renner.uno/gitea_admin/homelab/pulls/215
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#196