anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-23 02:36:57 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Security: GitHub Action leaks environment variables into PR comments #7967

New Issue
Open
opened 2026-02-16 18:08:48 -05:00 by yindo · 2 comments
yindo commented 2026-02-16 18:08:48 -05:00
Owner
Copy Link
Copy Source

Originally created by @frankbria on GitHub (Jan 29, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

Summary

The anomalyco/opencode/github@latest GitHub Action leaks environment variables (including sensitive tokens) into PR comments when posting reviews.

Security Impact

Severity: High

The following sensitive values were exposed in public PR comments:

  • GITHUB_TOKEN
  • ACTIONS_ID_TOKEN_REQUEST_TOKEN
  • ACTIONS_ID_TOKEN_REQUEST_URL
  • User-provided API keys (e.g., ZHIPU_API_KEY)
  • Various GITHUB_* context variables

This exposes credentials that could be used for unauthorized repository access or API abuse until the tokens expire.

Steps to Reproduce

1. Create a workflow using the opencode GitHub Action:                                                                                              

name: OpenCode PR Review                                                                                                                            
                                                                                                                                                    
on:                                                                                                                                                 
  pull_request:                                                                                                                                     
    types: [opened, synchronize]                                                                                                                    
                                                                                                                                                    
jobs:                                                                                                                                               
  opencode-review:                                                                                                                                  
    runs-on: ubuntu-latest                                                                                                                          
    permissions:                                                                                                                                    
      id-token: write                                                                                                                               
      contents: read                                                                                                                                
      pull-requests: write                                                                                                                          
      issues: write                                                                                                                                 
                                                                                                                                                    
    steps:                                                                                                                                          
      - name: Checkout repository                                                                                                                   
        uses: actions/checkout@v6                                                                                                                   
                                                                                                                                                    
      - name: Run OpenCode PR Review                                                                                                                
        uses: anomalyco/opencode/github@latest                                                                                                      
        env:                                                                                                                                        
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}                                                                                                 
          ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}                                                                                               
        with:                                                                                                                                       
          model: zai-coding-plan/glm-4.7                                                                                                            
          use_github_token: true                                                                                                                    
          prompt: |                                                                                                                                 
            Please review this pull request...
  1. Open a PR that triggers the workflow
  2. Observe the PR comment posted by the action

Expected Behavior

The action should post only the code review content without exposing any environment variables or internal state.

Actual Behavior

The action dumps environment variables into the PR comment, including:

  • Full GITHUB_TOKEN value
  • ACTIONS_ID_TOKEN_REQUEST_TOKEN
  • All GITHUB_* context variables
  • User-provided secrets passed via env:

Example of leaked content structure (redacted):
GITHUB_TOKEN=ghs_xxxxxxxxxxxx
ACTIONS_ID_TOKEN_REQUEST_TOKEN=eyJhbGciOi...
ZHIPU_API_KEY=xxxxxxxx

Mitigation Taken

We immediately:

  1. Deleted the leaked PR comments via GitHub API
  2. Disabled the workflow with if: false

Recommended Fix

  1. Sanitize output before posting to PR comments
  2. Never include raw environment variable dumps in user-facing output
  3. Use an allowlist of safe variables if debugging output is needed
  4. Consider using GitHub's secret masking for any output

Environment

  • Action version: anomalyco/opencode/github@latest
  • Model: zai-coding-plan/glm-4.7
  • Runner: ubuntu-latest

Plugins

No response

OpenCode version

No response

Steps to reproduce

  1. Create a workflow using the opencode GitHub Action:
name: OpenCode PR Review                                                                                                                            
                                                                                                                                                    
on:                                                                                                                                                 
  pull_request:                                                                                                                                     
    types: [opened, synchronize]                                                                                                                    
                                                                                                                                                    
jobs:                                                                                                                                               
  opencode-review:                                                                                                                                  
    runs-on: ubuntu-latest                                                                                                                          
    permissions:                                                                                                                                    
      id-token: write                                                                                                                               
      contents: read                                                                                                                                
      pull-requests: write                                                                                                                          
      issues: write                                                                                                                                 
                                                                                                                                                    
    steps:                                                                                                                                          
      - name: Checkout repository                                                                                                                   
        uses: actions/checkout@v6                                                                                                                   
                                                                                                                                                    
      - name: Run OpenCode PR Review                                                                                                                
        uses: anomalyco/opencode/github@latest                                                                                                      
        env:                                                                                                                                        
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}                                                                                                 
          ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }}                                                                                               
        with:                                                                                                                                       
          model: zai-coding-plan/glm-4.7                                                                                                            
          use_github_token: true                                                                                                                    
          prompt: |                                                                                                                                 
            Please review this pull request...
  1. Open a PR that triggers the workflow
  2. Observe the PR comment posted by the action

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @frankbria on GitHub (Jan 29, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description ## Summary The `anomalyco/opencode/github@latest` GitHub Action leaks environment variables (including sensitive tokens) into PR comments when posting reviews. ## Security Impact **Severity: High** The following sensitive values were exposed in public PR comments: - `GITHUB_TOKEN` - `ACTIONS_ID_TOKEN_REQUEST_TOKEN` - `ACTIONS_ID_TOKEN_REQUEST_URL` - User-provided API keys (e.g., `ZHIPU_API_KEY`) - Various `GITHUB_*` context variables This exposes credentials that could be used for unauthorized repository access or API abuse until the tokens expire. ## Steps to Reproduce 1. Create a workflow using the opencode GitHub Action: ```yaml name: OpenCode PR Review on: pull_request: types: [opened, synchronize] jobs: opencode-review: runs-on: ubuntu-latest permissions: id-token: write contents: read pull-requests: write issues: write steps: - name: Checkout repository uses: actions/checkout@v6 - name: Run OpenCode PR Review uses: anomalyco/opencode/github@latest env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }} with: model: zai-coding-plan/glm-4.7 use_github_token: true prompt: | Please review this pull request... ``` 2. Open a PR that triggers the workflow 3. Observe the PR comment posted by the action Expected Behavior The action should post only the code review content without exposing any environment variables or internal state. Actual Behavior The action dumps environment variables into the PR comment, including: - Full GITHUB_TOKEN value - ACTIONS_ID_TOKEN_REQUEST_TOKEN - All GITHUB_* context variables - User-provided secrets passed via env: Example of leaked content structure (redacted): GITHUB_TOKEN=ghs_xxxxxxxxxxxx ACTIONS_ID_TOKEN_REQUEST_TOKEN=eyJhbGciOi... ZHIPU_API_KEY=xxxxxxxx Mitigation Taken We immediately: 1. Deleted the leaked PR comments via GitHub API 2. Disabled the workflow with if: false Recommended Fix 1. Sanitize output before posting to PR comments 2. Never include raw environment variable dumps in user-facing output 3. Use an allowlist of safe variables if debugging output is needed 4. Consider using GitHub's secret masking for any output Environment - Action version: anomalyco/opencode/github@latest - Model: zai-coding-plan/glm-4.7 - Runner: ubuntu-latest ### Plugins _No response_ ### OpenCode version _No response_ ### Steps to reproduce 1. Create a workflow using the opencode GitHub Action: ```yaml name: OpenCode PR Review on: pull_request: types: [opened, synchronize] jobs: opencode-review: runs-on: ubuntu-latest permissions: id-token: write contents: read pull-requests: write issues: write steps: - name: Checkout repository uses: actions/checkout@v6 - name: Run OpenCode PR Review uses: anomalyco/opencode/github@latest env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ZHIPU_API_KEY: ${{ secrets.ZHIPU_API_KEY }} with: model: zai-coding-plan/glm-4.7 use_github_token: true prompt: | Please review this pull request... ``` ---- 2. Open a PR that triggers the workflow 3. Observe the PR comment posted by the action ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the bug label 2026-02-16 18:08:48 -05:00
yindo commented 2026-02-16 18:08:48 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 30, 2026):

was this a prompt injection case where it tells the agent to include env vars in it's response or something?

@rekram1-node commented on GitHub (Jan 30, 2026): was this a prompt injection case where it tells the agent to include env vars in it's response or something?
yindo commented 2026-02-16 18:08:48 -05:00
Author
Owner
Copy Link
Copy Source

@frankbria commented on GitHub (Jan 31, 2026):

No. The above code is the standard script that's run a bunch of times.

@frankbria commented on GitHub (Jan 31, 2026): No. The above code is the standard script that's run a bunch of times.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7967
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?