Impersonation issue

[nobe4]

The current checks uses author name to ensure that the changes were made by the expected user.

privileged-requester/src/runner.js

Lines 16 to 23 in fdd9f57

	for (const [, commit] of Object.entries(this.pullRequest.listCommits())) {
	let commitAuthor = commit.author.login.toLowerCase();
	if (commitAuthor !== privileged_requester_username) {
	core.warning(
	`Unexpected commit author found by ${commitAuthor}! Commits should be authored by ${privileged_requester_username} I will not proceed with the privileged reviewer process.`,
	);
	return false;

It is however really easy to make a commit with a different name, or email address.

git -c user.name='Linus Torvalds' -c user.email='torvalds@linux-foundation.org' commit -m "Wow, this is definitely legit."

This poses a serious risk of impersonation.

[nobe4]

The GitHub API, provide commit verification information that is parsed in

privileged-requester/src/runner.js

Line 16 in fdd9f57

for (const [, commit] of Object.entries(this.pullRequest.listCommits())) {

Format:

      "verification": {
        "verified": false,
        "reason": "unsigned",
        "signature": null,
        "payload": null
      }

E.g. gh api /repos/X/Y/pulls/Z/commits | jq '.[].commit.verification':

{
  "payload": null,
  "reason": "unsigned",
  "signature": null,
  "verified": false
},
{
  "payload": "tree xxx\nparent yyy\nparent zzz\nauthor nobe4 <nobe4@users.noreply.github.com>...",
  "reason": "valid",
  "signature": "-----BEGIN PGP SIGNATURE-----\n\nwsFcBA...n-----END PGP SIGNATURE-----\n",
  "verified": true
}

It is possible to add:

    for (const [, commit] of Object.entries(this.pullRequest.listCommits())) {
      let commitAuthor = commit.author.login.toLowerCase();

+     if (!commit.verification.verified) {
+       core.warning("Unexpected unverified commit.");
+       return false.
+     }

      if (commitAuthor !== privileged_requester_username) {
        core.warning(
          `Unexpected commit author found by ${commitAuthor}! Commits should be authored by ${privileged_requester_username} I will not proceed with the privileged reviewer process.`,
        );
        return false;
      }
    }

[GrantBirki]

@nobe4 I'll work on implementing this 🚀