From 0d9d8f0ff2f8f4f4a44feed7f4864a913f64d510 Mon Sep 17 00:00:00 2001 From: naokihaba <59875779+naokihaba@users.noreply.github.com> Date: Thu, 20 Aug 2026 22:57:11 +0900 Subject: [PATCH 1/2] fix: pass through GitHub Actions OIDC URL --- crates/vt_graph/src/config/mod.rs | 2 ++ crates/vt_plan/src/envs.rs | 19 +++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/crates/vt_graph/src/config/mod.rs b/crates/vt_graph/src/config/mod.rs index ef39165b6..6b776a7f4 100644 --- a/crates/vt_graph/src/config/mod.rs +++ b/crates/vt_graph/src/config/mod.rs @@ -444,6 +444,8 @@ pub const DEFAULT_UNTRACKED_ENV: &[&str] = &[ // GitHub Actions "GITHUB_*", "RUNNER_*", + "ACTIONS_ID_TOKEN_REQUEST_URL", + // ACTIONS_ID_TOKEN_REQUEST_TOKEN is covered by *_TOKEN below. // Windows specific "APPDATA", // Node's compile cache uses LOCALAPPDATA to pick its cache directory diff --git a/crates/vt_plan/src/envs.rs b/crates/vt_plan/src/envs.rs index 735ce5b45..c9ac38b82 100644 --- a/crates/vt_plan/src/envs.rs +++ b/crates/vt_plan/src/envs.rs @@ -178,6 +178,8 @@ fn resolve_envs_with_patterns<'a>( #[cfg(test)] mod tests { + use vt_graph::config::DEFAULT_UNTRACKED_ENV; + use super::*; fn create_test_envs(pairs: Vec<(&str, &str)>) -> FxHashMap, Arc> { @@ -558,4 +560,21 @@ mod tests { // Non-matching env should be filtered out assert!(!envs.contains_key(OsStr::new("OTHER_VAR"))); } + + #[test] + fn test_github_actions_oidc_env_untracked() { + let env_config = create_env_config(&[], DEFAULT_UNTRACKED_ENV); + + let mut envs = create_test_envs(vec![ + ("ACTIONS_ID_TOKEN_REQUEST_URL", "https://example.com/id-token"), + ("ACTIONS_ID_TOKEN_REQUEST_TOKEN", "request-token"), + ("ACTIONS_UNRELATED", "should-be-filtered"), + ]); + + let _result = EnvFingerprints::resolve(&mut envs, &env_config).unwrap(); + + assert!(envs.contains_key(OsStr::new("ACTIONS_ID_TOKEN_REQUEST_URL"))); + assert!(envs.contains_key(OsStr::new("ACTIONS_ID_TOKEN_REQUEST_TOKEN"))); + assert!(!envs.contains_key(OsStr::new("ACTIONS_UNRELATED"))); + } } From 8fb587c37f58cb75b0a4303e528d6be653a2aae8 Mon Sep 17 00:00:00 2001 From: naokihaba <59875779+naokihaba@users.noreply.github.com> Date: Thu, 20 Aug 2026 23:04:17 +0900 Subject: [PATCH 2/2] fix: add ACTIONS_ID_TOKEN_REQUEST_URL to untracked environment variables --- crates/vt_graph/src/config/mod.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crates/vt_graph/src/config/mod.rs b/crates/vt_graph/src/config/mod.rs index 6b776a7f4..24d077121 100644 --- a/crates/vt_graph/src/config/mod.rs +++ b/crates/vt_graph/src/config/mod.rs @@ -444,8 +444,9 @@ pub const DEFAULT_UNTRACKED_ENV: &[&str] = &[ // GitHub Actions "GITHUB_*", "RUNNER_*", - "ACTIONS_ID_TOKEN_REQUEST_URL", + // https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-cloud-providers#using-custom-actions // ACTIONS_ID_TOKEN_REQUEST_TOKEN is covered by *_TOKEN below. + "ACTIONS_ID_TOKEN_REQUEST_URL", // Windows specific "APPDATA", // Node's compile cache uses LOCALAPPDATA to pick its cache directory