[sec-check] validate-brewfiles.yml: brew bundle check evaluates PR-controlled Brewfile as Ruby — code exec on PR trigger

[kubestellar-hive]

Security Finding

Severity: medium
Type: unsafe-pattern (PR-triggered code execution)

.github/workflows/validate-brewfiles.yml runs on pull_request targeting custom/brew/** and executes:

brew bundle check --file="$brewfile"

A Brewfile is a Ruby DSL. brew bundle check loads the file via Homebrew's DSL evaluator, which executes arbitrary Ruby in the Brewfile (e.g. system "..." or backticks at top level). A malicious PR touching custom/brew/** therefore gets code execution in CI without merge.

Impact

Mitigations present: the workflow declares permissions: contents: read, uses no repository secrets, and the runner is ephemeral — so blast radius is bounded to:

• Arbitrary code execution on the runner (compute abuse, network egress)
• PR check spoofing (attacker controls exit status of the validation check)
• Outbound requests from the GitHub Actions IP range (could be leveraged against rate-limited/internal-adjacent services)

No secrets or write tokens are exposed, which is why this is medium and not high.

Recommendation

Pick one:

1. Gate on fork PRs — require maintainer approval before the workflow runs on pull_request from forks (repo setting: "Require approval for all outside contributors"), and document why.
2. Static-parse instead of eval — replace brew bundle check with a syntax-only check (ruby -c equivalents / grep-based validation of brew/cask lines) so the Brewfile is never executed.
3. Sandbox the eval — run the check inside a networkless container (--network none) with no mounted credentials.

Option 2 is the strongest; option 1 is the cheapest.

---

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)

🐝 Hive Agent: security | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=sec-check backend=copilot model=kimi-k3

[github-actions]

The workflow labels were repaired to 2-discussing. Keep exactly one workflow state label; blocked and hold may be used as overlays.

[kubestellar-hive]

sec-check update: fix implemented and verified, but the hive GitHub App token for this repo lacks the workflows permission, so the fix branch cannot be pushed (refusing to allow a GitHub App to create or update workflow ... without workflows permission). No PR opened — a maintainer with workflow write access can apply the ready patch below, or grant the App workflow scope and I will open the hold-gated PR on the next pass.

Verified locally: YAML parses; the directive whitelist passes all three existing Brewfiles and rejects a system "id" line; the reusable workflow at the pinned SHA declares no secrets and uses only github.token.

diff --git a/.github/workflows/validate-brewfiles.yml b/.github/workflows/validate-brewfiles.yml
index 0555911..fe70c62 100644
--- a/.github/workflows/validate-brewfiles.yml
+++ b/.github/workflows/validate-brewfiles.yml
@@ -13,22 +13,30 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@a657b8b0cd35d0f65cce41fce9b24cf054b49869 # master
-
-      - name: Validate Brewfiles
+      - name: Validate Brewfiles (static, no eval)
         shell: bash
         run: |
           echo "Validating Brewfiles in custom/brew/ directory..."
 
+          # A Brewfile is a Ruby DSL: `brew bundle check` EVALUATES it, giving
+          # PR-controlled code execution on this pull_request trigger. Validate
+          # statically instead: ruby syntax check plus a directive whitelist —
+          # the Brewfile is never executed.
           find "custom/brew" -iname '*\.Brewfile*' -print0 | \
             while IFS= read -r -d '' brewfile ; do
               echo "::group:: ===$(basename "$brewfile")==="
-              if brew bundle check --file="$brewfile" 2>&1; then
-                echo "✓ $brewfile is valid"
-              else
-                echo "✗ $brewfile validation failed"
+              if ! ruby -c "$brewfile" >/dev/null 2>&1; then
+                echo "✗ $brewfile has invalid Ruby syntax"
+                exit 1
+              fi
+              # Only blank lines, comments, and tap/brew/cask/mas/vscode
+              # directive lines are permitted; anything else could be
+              # executable Ruby if this file is ever eval'd again.
+              if bad=$(grep -nEv '^[[:space:]]*(#.*)?$|^[[:space:]]*(tap|brew|cask|mas|vscode)[[:space:]]+"[^"]+"' "$brewfile"); then
+                echo "✗ $brewfile contains non-directive lines (possible executable Ruby):"
+                echo "$bad"
                 exit 1
               fi
+              echo "✓ $brewfile is valid"
               echo "::endgroup::"
             done

---

sec-check agent (ACMM L4/L5 — hold-gated mode) — advisory only, no workaround attempted

🐝 Hive Agent: security | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: e207a20

— hive: agent=sec-check backend=copilot model=kimi-k3