fix: secure generated file healing workflow

.github/workflows/heal-generated-files-finalize.yml

@@ -0,0 +1,178 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+# Privileged companion to heal-generated-files.yml. This workflow is loaded
+# from the repository default branch. It never executes artifact or pull
+# request code. The App token is created only after the candidate commit has
+# been reconstructed from its exact parents and fully verified.
+
+name: Finalize Generated File Healing
+
+on:
+  workflow_run:
+    workflows: ["Prepare Generated File Healing"]
+    types: [completed]
+
+concurrency:
+  group: finalize-generated-file-healing
+  cancel-in-progress: false
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+
+jobs:
+  finalize:
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      contains(fromJSON('["pull_request", "push", "workflow_dispatch"]'), github.event.workflow_run.event)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve current trusted revision and pull request metadata
+        id: metadata
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const fs = require("node:fs");
+            const path = require("node:path");
+            const { owner, repo } = context.repo;
+            const repository = `${owner}/${repo}`;
+            const repositoryResponse = await github.rest.repos.get({ owner, repo });
+            const defaultBranch = repositoryResponse.data.default_branch;
+            const branchResponse = await github.rest.repos.getBranch({
+              owner,
+              repo,
+              branch: defaultBranch,
+            });
+            const trustedSha = branchResponse.data.commit.sha;
+            if (!/^[0-9a-f]{40}$/.test(trustedSha)) {
+              core.setFailed("The default branch did not resolve to a full commit SHA.");
+              return;
+            }
+            let pullRequests = await github.paginate(github.rest.pulls.list, {
+              owner,
+              repo,
+              state: "open",
+              base: defaultBranch,
+              per_page: 100,
+            });
+            pullRequests = pullRequests.filter(
+              (pullRequest) => pullRequest.head.repo?.full_name === repository,
+            );
+            const metadata = {
+              repository,
+              defaultBranch,
+              trustedSha,
+              runId: String(context.payload.workflow_run.id),
+              pullRequests: pullRequests.map((pullRequest) => ({
+                number: pullRequest.number,
+                state: pullRequest.state,
+                isCrossRepository:
+                  pullRequest.head.repo?.full_name !== pullRequest.base.repo?.full_name,
+                headRepository: pullRequest.head.repo?.full_name,
+                baseRepository: pullRequest.base.repo?.full_name,
+                headRefName: pullRequest.head.ref,
+                headSha: pullRequest.head.sha,
+                baseRefName: pullRequest.base.ref,
+                baseSha: pullRequest.base.sha,
+              })),
+            };
+            const metadataPath = path.join(
+              process.env.RUNNER_TEMP,
+              "generated-file-healing-live-metadata.json",
+            );
+            fs.writeFileSync(metadataPath, `${JSON.stringify(metadata, null, 2)}\n`);
+            core.setOutput("path", metadataPath);
+            core.setOutput("default_branch", defaultBranch);
+            core.setOutput("trusted_sha", trustedSha);
+
+      - name: Checkout trusted finalizer
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ steps.metadata.outputs.trusted_sha }}
+          fetch-depth: 0
+          path: trusted
+          persist-credentials: false
+
+      - name: Verify trusted finalizer revision
+        env:
+          DEFAULT_BRANCH: ${{ steps.metadata.outputs.default_branch }}
+          REPOSITORY: ${{ github.repository }}
+          TRUSTED_SHA: ${{ steps.metadata.outputs.trusted_sha }}
+        run: |
+          set -euo pipefail
+          test "$(git -C trusted rev-parse HEAD)" = "$TRUSTED_SHA"
+          remote_sha="$(
+            git -c credential.helper= -c credential.interactive=never \
+              ls-remote "https://github.com/${REPOSITORY}.git" \
+              "refs/heads/${DEFAULT_BRANCH}" | awk '{print $1}'
+          )"
+          test "$remote_sha" = "$TRUSTED_SHA"
+          git -C trusted merge-base --is-ancestor "$TRUSTED_SHA" "$remote_sha"
+
+      - name: Install trusted pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          package_json_file: trusted/ts/package.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 22
+
+      - name: Download candidate artifact
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: generated-file-healing-${{ github.event.workflow_run.id }}
+          path: ${{ runner.temp }}/generated-file-healing
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Verify candidate object graph and live pull request state
+        id: verify
+        env:
+          LIVE_METADATA_PATH: ${{ steps.metadata.outputs.path }}
+          REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+        run: |
+          set -euo pipefail
+          plan="$RUNNER_TEMP/generated-file-healing-plan.json"
+          node trusted/ts/tools/scripts/heal-generated-files.mjs verify \
+            --artifact "$RUNNER_TEMP/generated-file-healing" \
+            --live-metadata "$LIVE_METADATA_PATH" \
+            --run-id "$RUN_ID" \
+            --repository-url "https://github.com/${REPOSITORY}.git" \
+            --pnpm "$(command -v pnpm)" \
+            --plan "$plan"
+          echo "plan=$plan" >> "$GITHUB_OUTPUT"
+          candidate_count="$(
+            node -p \
+              "JSON.parse(require('fs').readFileSync(process.argv[1])).candidates.length" \
+              "$plan"
+          )"
+          echo "candidate_count=$candidate_count" >> "$GITHUB_OUTPUT"
+
+      - name: Mint minimally scoped App token
+        id: app-token
+        if: steps.verify.outputs.candidate_count != '0'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.DEPENDABOT_APP_ID }}
+          private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: read
+
+      - name: Revalidate and push with exact-head lease
+        if: steps.verify.outputs.candidate_count != '0'
+        env:
+          GITHUB_API_URL: ${{ github.api_url }}
+          HEAL_PUSH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PLAN_PATH: ${{ steps.verify.outputs.plan }}
+        run: |
+          set -euo pipefail
+          node trusted/ts/tools/scripts/heal-generated-files.mjs push \
+            --plan "$PLAN_PATH"