github-app: test repositories, not repository (#2011)

* github-app: test `repositories`, not `repository`

* Record changes

* Clean up test

Author: woodruffw

crates/zizmor/src/audit/github_app.rs

@@ -116,10 +116,10 @@ impl GitHubApp {
             }
         }
 
-        // `owner: ...` without `repository: ...` grants the app token access to all
+        // `owner: ...` without `repositories: ...` grants the app token access to all
         // repositories in the owner's account, which is likely more access than the
         // user intended.
-        if with.contains_key("owner") && !with.contains_key("repository") {
+        if with.contains_key("owner") && !with.contains_key("repositories") {
             findings.push(
                 Self::finding()
                     .confidence(Confidence::High)

crates/zizmor/tests/integration/audit/github_app.rs

@@ -8,61 +8,61 @@ fn test_regular_persona() -> anyhow::Result<()> {
             .run()?,
         @"
     error[github-app]: dangerous use of GitHub App tokens
-      --> @@INPUT@@:19:11
+      --> @@INPUT@@:21:11
        |
-    17 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+    19 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        |               ------------------------------------------------------------------------ app token requested here
-    18 |         with:
-    19 |           skip-token-revoke: true
+    20 |         with:
+    21 |           skip-token-revoke: true
        |           ^^^^^^^^^^^^^^^^^^^^^^^ token revocation disabled here
        |
        = note: audit confidence → High
 
     error[github-app]: dangerous use of GitHub App tokens
-      --> @@INPUT@@:27:11
+      --> @@INPUT@@:29:11
        |
-    25 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+    27 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        |               ------------------------------------------------------------------------ app token requested here
-    26 |         with:
-    27 |           skip-token-revoke: ${{ github.ref_name == 'main' }}
+    28 |         with:
+    29 |           skip-token-revoke: ${{ github.ref_name == 'main' }}
        |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ token revocation conditionally disabled here
        |
        = note: audit confidence → Low
 
     error[github-app]: dangerous use of GitHub App tokens
-      --> @@INPUT@@:35:11
+      --> @@INPUT@@:37:11
        |
-    33 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+    35 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        |               ------------------------------------------------------------------------ app token requested here
-    34 |         with:
-    35 |           owner: github
+    36 |         with:
+    37 |           owner: github
        |           ^^^^^^^^^^^^^ token granted access to all repositories for this owner's app installation
        |
        = note: audit confidence → High
        = tip: use `repositories: 'repo1,repo2'` to scope the token to specific repositories
 
     error[github-app]: dangerous use of GitHub App tokens
-      --> @@INPUT@@:43:11
+      --> @@INPUT@@:45:11
        |
-    41 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+    43 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        |               ------------------------------------------------------------------------ app token requested here
-    42 |         with:
-    43 |           owner: github
+    44 |         with:
+    45 |           owner: github
        |           ^^^^^^^^^^^^^ token granted access to all repositories for this owner's app installation
        |
        = note: audit confidence → High
        = tip: use `repositories: 'repo1,repo2'` to scope the token to specific repositories
 
     error[github-app]: dangerous use of GitHub App tokens
-      --> @@INPUT@@:41:15
+      --> @@INPUT@@:43:15
        |
-    41 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+    43 |         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ app token inherits blanket installation permissions
        |
        = note: audit confidence → High
        = tip: specify at least one `permission-<name>` input to limit the token's permissions
 
-    9 findings (4 suppressed): 0 informational, 0 low, 0 medium, 5 high
+    5 findings: 0 informational, 0 low, 0 medium, 5 high
     ");
     Ok(())
 }

crates/zizmor/tests/integration/test-data/github-app.yml

@@ -12,6 +12,8 @@ jobs:
   github-app:
     name: github-app
     runs-on: ubuntu-latest
+    environment:
+      name: test
     steps:
       - name: github-app-skips-token-revoke
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
@@ -43,3 +45,13 @@ jobs:
           owner: github
           client-id: ${{ vars.GHES_APP_CLIENT_ID }}
           private-key: ${{ secrets.GHES_APP_PRIVATE_KEY }}
+
+      # OK: repositories is explicitly provided.
+      - name: github-app-owner-with-repositories
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          owner: github
+          repositories: github/docs
+          client-id: ${{ vars.GHES_APP_CLIENT_ID }}
+          private-key: ${{ secrets.GHES_APP_PRIVATE_KEY }}
+          permission-issues: write

docs/release-notes.md

@@ -23,6 +23,9 @@ of `zizmor`.
 
     Many thanks to @martincostello for implementing this fix!
 
+* Fixed a bug where the [github-app] audit would incorrectly flag some safe
+  uses of @actions/create-github-app-token as unsafe (#2011)
+
 ## 1.25.0
 
 ### New Features 🌈