Allow GitHub Actions to create and approve pull requests
Why Tier 1
Turned on, a workflow's GITHUB_TOKEN can approve pull requests, and that approval counts towards required reviews. Anyone who can change a workflow can then get code merged without a person reviewing it.
The workflow permissions setting that lets GITHUB_TOKEN create and approve pull requests. New organizations start with it off.
Available on: Every setup. Source
Attack path
An attacker with write access opens a pull request and a workflow that approves it. With the setting on, the approval satisfies the review rule and the change merges.
Mitigations
- Turn the setting off at the enterprise or organization level
- Require reviews from code owners, which a workflow cannot be
Detect
Alert on org.set_workflow_permission_can_approve_pr, business.set_workflow_permission_can_approve_pr, repo.set_workflow_permission_can_approve_pr in the audit log.
Related permissions
GitHub Docs: Disabling or limiting GitHub Actions for your organization