From 54ace062ebaca6405ed37f0c6e0b7159d10e61b8 Mon Sep 17 00:00:00 2001 From: iscai-msft Date: Fri, 4 Sep 2026 12:43:25 -0400 Subject: [PATCH] Fix cache poisoning code scanning alerts in Python integration workflows Remove the workflow_dispatch trigger from python-integration.yml and external-integration.yml. Both workflows check out untrusted PR code and use caching; the workflow_dispatch trigger runs on the default branch and therefore has write access to the default-branch cache scope, which CodeQL flags as a cache poisoning risk (actions/cache-poisoning/poisonable-step). Restricting these workflows to the pull_request trigger scopes their cache to the PR branch, matching the 'Correct Usage' example in the CodeQL rule, and resolves all 36 open alerts. The azure-rest-api-specs job keeps its label-based (int:azure-specs) manual trigger. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/external-integration.yml | 4 +--- .github/workflows/python-integration.yml | 2 -- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/external-integration.yml b/.github/workflows/external-integration.yml index 7ed9a1f08d0..5e6192ba707 100644 --- a/.github/workflows/external-integration.yml +++ b/.github/workflows/external-integration.yml @@ -9,8 +9,6 @@ on: - "packages/http-client-python/**" - "website/**" - "docs/**" - # Allow manual triggering - workflow_dispatch: permissions: contents: read @@ -73,7 +71,7 @@ jobs: azure-rest-api-specs: name: Azure REST API Specs runs-on: ubuntu-latest - if: contains(github.event.pull_request.labels.*.name, 'int:azure-specs') || github.event_name == 'workflow_dispatch' + if: contains(github.event.pull_request.labels.*.name, 'int:azure-specs') steps: - name: Checkout repository diff --git a/.github/workflows/python-integration.yml b/.github/workflows/python-integration.yml index 488eddf690c..10ebb692ccd 100644 --- a/.github/workflows/python-integration.yml +++ b/.github/workflows/python-integration.yml @@ -6,8 +6,6 @@ on: paths: - "packages/http-client-python/**" - ".github/workflows/python-integration.yml" - # Allow manual triggering - workflow_dispatch: permissions: contents: read