[I] Security: Codecov upload token committed in plaintext in .github/workflows/coverage.yml (please rotate + move to a secret) [rocketmq]

["kobihikri (via GitHub)" <gi...@apache.org>]

kobihikri opened a new issue, #10617:
URL: https://github.com/apache/rocketmq/issues/10617

   ### What happened
   
   `.github/workflows/coverage.yml` hardcodes a **Codecov upload token in plaintext** and passes it to a third-party action:
   
   - **line 30** — `token: <redacted>` (a Codecov upload token, committed in the clear)
   - line 26 — `uses: codecov/codecov-action@v3`
   - line 16 — `uses: actions/checkout@master`
   
   (I've redacted the token value here on purpose and have not tested it against any service — I'm only reporting that a credential is committed.)
   
   ### Why it matters
   
   A credential committed to a public repository is readable by anyone and should be treated as compromised. Codecov *upload* tokens are limited in scope (they permit uploading coverage reports, not code push/read), so the blast radius is bounded — but the standard, low-risk fix is to **rotate the token and move it to a repository secret**. Every other credential in this repo's workflows already uses `${{ secrets.* }}` (e.g. `DOCKERHUB_TOKEN`, `NEXUS_PW`), so this one line is the exception.
   
   There's also a small supply-chain angle: the token is handed to `codecov/codecov-action@v3` (a mutable major tag) in a job that also uses `actions/checkout@master` (a mutable branch), so pinning those to full commit SHAs would harden the path the credential flows through.
   
   ### Suggested fix
   
   1. **Rotate** the current Codecov token (regenerate it in Codecov).
   2. Store it as a repository secret and reference it: `token: ${{ secrets.CODECOV_TOKEN }}`.
   3. (Optional) Pin `codecov/codecov-action` and `actions/checkout` to full commit SHAs.
   
   Happy to send a PR for the workflow change once the token is rotated (I understand PRs need an ICLA on file). I used AI assistance to spot this; I verified the file and line numbers myself and did not exfiltrate or use the credential.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Security: Codecov upload token committed in plaintext in .github/workflows/coverage.yml (please rotate + move to a secret) [rocketmq]

["RockteMQ-AI (via GitHub)" <gi...@apache.org>]

RockteMQ-AI commented on issue #10617:
URL: https://github.com/apache/rocketmq/issues/10617#issuecomment-4969460509

   **Issue Evaluation**
   
   Category: `type/bug` (security) | Status: **Confirmed**
   
   Thank you @kobihikri for the responsible disclosure. The issue has been verified against the current codebase.
   
   **Root Cause:** The Codecov upload token is hardcoded in plaintext at line 30 of `.github/workflows/coverage.yml` instead of referencing a repository secret.
   
   **Impact:** The token is publicly readable in the repository history. Codecov upload tokens have limited scope (coverage report uploads only), so the blast radius is bounded — but it should still be treated as compromised per standard security practice.
   
   **Severity:** Medium
   
   **Suggested remediation:**
   1. Rotate the current Codecov token immediately (regenerate in Codecov dashboard)
   2. Store the new token as a repository secret (e.g. `CODECOV_TOKEN`)
   3. Update the workflow to reference it: `token: $\{{ secrets.CODECOV_TOKEN }}`
   4. *(Optional)* Pin `codecov/codecov-action` and `actions/checkout` to full commit SHAs for supply-chain hardening
   
   A PR for the workflow change is welcome. Note that the token rotation itself must be done by a maintainer with repository admin access.
   
   ---
   *Automated evaluation by RockteMQ-AI*


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org