From 522c331d66f417c88d8e332b4be01ffb1533cc7a Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 21:31:41 +0000
Subject: [PATCH] fix(security): remediate workflow vulnerability in
 .github/workflows/pr-comment-build.yaml

---
 .github/workflows/pr-comment-build.yaml | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/pr-comment-build.yaml b/.github/workflows/pr-comment-build.yaml
index 9317e02a..dac6077e 100644
--- a/.github/workflows/pr-comment-build.yaml
+++ b/.github/workflows/pr-comment-build.yaml
@@ -12,10 +12,10 @@ permissions:
 
 jobs:
   handle-comment:
-    if: ${{ github.event.issue.pull_request }}
+    if: ${{ github.event.issue.pull_request && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 1
@@ -27,28 +27,23 @@ jobs:
           COMMENT_ID: ${{ github.event.comment.id }}
           COMMENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
           COMMENT_AUTHOR: ${{ github.event.comment.user.login }}
-          COMMENT_AUTHOR_ASSOCIATION: ${{ github.event.comment.author_association }}
           COMMENT_SENDER_TYPE: ${{ github.event.sender.type }}
           COMMENT_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           set -eu
           if [ "${#COMMENT_BODY}" -gt 1024 ]; then
             echo "Ignoring oversized comment payload."
-            exit 0
+            exit 1
           fi
           case "$COMMENT_BODY" in
             /kernel-bot*) ;;
             *)
               echo "Ignoring non /kernel-bot comment."
-              exit 0
+              exit 1
               ;;
           esac
           if ! printf '%s' "$COMMENT_BODY" | grep -Eq '^/kernel-bot[][ A-Za-z0-9_,./-]*$'; then
             echo "Ignoring /kernel-bot comment with unsupported characters."
-            exit 0
-          fi
-          if [[ "$COMMENT_AUTHOR_ASSOCIATION" != "MEMBER" && "$COMMENT_AUTHOR_ASSOCIATION" != "OWNER" && "$COMMENT_AUTHOR_ASSOCIATION" != "COLLABORATOR" ]]; then
-            echo "Unauthorized: Only members, owners, and collaborators can use /kernel-bot."
-            exit 0
+            exit 1
           fi
           python3 .github/scripts/pr_comment_kernel_bot.py