Require approval before fork pull requests run workflows #440

Summary

The production runner prod.docs.plus holds the production .env and the Docker socket. The production workflow runs on pull_request to main, and GitHub runs the pull request's own YAML. A past contributor's fork skips approval under GitHub's default policy. So a fork pull request from a past contributor can run its own job on the production runner.

The production environment reviewer does not stop this, because the job's YAML comes from the fork. One repo setting closes it.

• Severity: Critical
• Area: GitHub Actions repo settings
• Source: security review of 2026-10-06, finding C2 (split from Run only reviewed main-branch workflows on the production runner #437)

Production check

• A first-time contributor's run waits at action_required. Past contributors skip that approval under GitHub's default policy.
• GitHub settings were not otherwise checked.

Where

• Jobs on the production runner: .github/workflows/prod.docs.plus.yml:420 (deploy) and :968 (uptime-kuma-deploy), .github/workflows/observability.docs.plus.yml:37 and :147. A forked workflow can add another job with runs-on: prod.docs.plus.
• prod.docs.plus.yml:34 runs on pull_request to main. GitHub runs the pull request's own YAML.

Fix plan

1. Fork pull requests (maintainer, repo settings). Settings → Actions → General → "Approval for running fork pull request workflows from contributors". Pick "Require approval for all external contributors".

Only the maintainer can change this setting. It takes minutes and needs no code change or deploy. Do it before any other issue from this review.

Out of scope

• Branch-write access to the production runner and the Traefik workspace mount. Run only reviewed main-branch workflows on the production runner #437 owns them.

Acceptance criteria

• Repo Settings → Actions shows approval required for all external contributors on fork pull requests.

Verify

1. Read the fork approval setting with gh api repos/docs-plus/docs.plus/actions/permissions/fork-pr-contributor-approval, or in the UI. It must name all external contributors.

Related

• Run only reviewed main-branch workflows on the production runner #437 (branch-write access and Traefik mount, finding M11)

Generated by Claude Code