Secure PAT_GITHUB_COM and document tflint native host-specific token - #8812
Merged
Conversation
nvuillam
requested review from
Kurt-von-Laven,
bdovaz and
echoix
as code owners
August 26, 2026 22:39
Contributor
✅
|
PAT_GITHUB_COM matched no entry of DEFAULT_SECURED_ENV_VARIABLES, so the GitHub Personal Access Token asked by the TERRAFORM_TFLINT documentation was sent in cleartext to every linter subprocess. - Replace the exact "PAT" entry of DEFAULT_SECURED_ENV_VARIABLES by the (^|_)(PAT)($|_) pattern, hiding PAT, PAT_* and *_PAT variables - Resolve replacement_env_vars var_src from the raw configuration instead of the already secured environment, so securing the source variable does not send HIDDEN_BY_MEGALINTER to tflint --init. Env build extracted in pre_post_factory.build_command_env() - Deprecate PAT_GITHUB_COM (warning logged when set) and document the tflint native GITHUB_TOKEN_github_com variable, used with TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES, as the recommended approach - Declare replacement_env_vars in the configuration JSON schema (command_info definition) and in the pre-commands documentation - Unit tests for the redaction and for the replacement resolution Fixes #8795
nvuillam
force-pushed
the
fix/secure-pat-github-com
branch
from
August 27, 2026 08:28
e3dafbe to
de74ffd
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #8795
Findings
A - Security:
PAT_GITHUB_COMwas never redacted.build_env()compares non-regex entries ofDEFAULT_SECURED_ENV_VARIABLESwith==, and the list contained the literalPAT. No entry matchedPAT_GITHUB_COM, so the GitHub Personal Access Token that theTERRAFORM_TFLINTdocumentation asks users to create was passed in cleartext to every linter subprocess (and printed in theLOG_LEVEL: DEBUGenv dump), unlikeGITHUB_TOKEN,SYSTEM_ACCESSTOKENand the other credential variables.B - Redundancy: tflint has a native equivalent.
getGitHubToken(plugin/install.go) resolvesGITHUB_TOKEN_{source_host}(e.g.GITHUB_TOKEN_github_com) with priority overGITHUB_TOKEN. It shipped in tflint v0.51.0, and MegaLinter pins v0.64.0. That variable contains_TOKEN_, so it is secured by default and works withTERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES.Fix
Both halves of the suggested remediation, without breaking the users who already set
PAT_GITHUB_COM.Secure it (immediate effect, even for existing users)
megalinter/config.py: the exactPATentry becomes the(^|_)(PAT)($|_)pattern, which hidesPAT,PAT_*and*_PATvariables (PAT_GITHUB_COM,AZURE_PAT...). Checked against every variable of the configuration JSON schema and against common environment variables:PATH,PATHEXT,GOPATH,NODE_PATH,PYTHONPATH,CLASSPATH,PATTERN,COMPATIBILITY... are not matched (the pattern requires a_or a boundary right afterPAT).megalinter/pre_post_factory.py: the ordering trap described in the issue.replacement_env_varsnow resolvesvar_srcfrom the raw configuration instead of the already secured environment, sotflint --initkeeps receiving the real token instead ofHIDDEN_BY_MEGALINTER. The environment build moved tobuild_command_env(), called byrun_command(). Nothing new is logged: only the command line is written to the logs, the resolved value never is.Deprecate it in favor of the native mechanism
terraform.megalinter-descriptor.yml: the tflint documentation now recommendsGITHUB_TOKEN_github_com+TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES, and flagsPAT_GITHUB_COMas deprecated (also in its variable description).TfLintLinterlogs a deprecation warning whenPAT_GITHUB_COMis set, following the wording of the linter deprecation warnings inMegaLinter.py. The variable keeps working; it is not removed in this PR.Adjacent schema gap
replacement_env_varsis added to thecommand_infodefinition ofmegalinter-configuration.jsonschema.json(array of{var_src, var_dest}), and documented in the Pre-commands page (example + property table row). It was implemented but validated by nothing.Verification
config_test.test_config_secure_env_vars_personal_access_tokens:PAT,PAT_GITHUB_COM,AZURE_PAT,MY_PAT_FOR_CIare hidden,PATH,PATH_TO_SOMETHING,COMPATIBILITY_MODEstay visible.pre_post_test.PrePostReplacementEnvVarsTest: without replacement bothGITHUB_TOKENandPAT_GITHUB_COMareHIDDEN_BY_MEGALINTERin the command environment; with the tflint replacement rule,GITHUB_TOKENreceives the realPAT_GITHUB_COMvalue whilePAT_GITHUB_COMitself stays hidden. This second test fails without thepre_post_factorychange.blackpass. The remainingconfig_testfailures in my environment are the network-dependent remote-config tests (TLS interception), unrelated.build.pyrun to regenerate the schema andmega-linter-runner/lib/megalinter-vars.json; only the files related to this change are committed.Not done here
PAT_GITHUB_COM, left for a future major release.docs/descriptors/terraform_tflint.mdpage, owned by the documentation auto-update workflow.GITHUB_TOKEN=HIDDEN_BY_MEGALINTER(reported separately in tflint doesn't work in megalinter 7.0.x #2699).