fix(controlplane): confine legacy robot accounts to their bound workflow - #3464
Merged
jiparis merged 1 commit intoSep 24, 2026
Merged
Conversation
Robot accounts are scoped to a single workflow, but findWorkflowFromTokenOrNameOrRunID resolved the workflow purely from the request, so any robot account could reach every workflow in its organization through GetContract, Init, Store and Cancel. Attestation endpoints skip the authz middleware and RBAC is disabled for robot accounts, leaving the handler as the only authorization point. The usercontext.RobotAccount carrier is shared with the API-token and federated middlewares, which leave WorkflowID empty, so the binding applies only when a workflow is actually encoded in the credential. Assisted-by: Claude Code Signed-off-by: Jose I. Paris <jiparis@chainloop.dev> Chainloop-Trace-Sessions: 119f621c-b024-493e-aa13-41acd7522345
Contributor
AI Session Checks — 🟡 60% · ✅ 0 failing
|
| Status | Attribution | File | Lines |
|---|---|---|---|
| modified | ai | app/controlplane/internal/service/attestation_integration_test.go |
+152 / -0 |
| modified | ai | app/controlplane/internal/service/attestation.go |
+9 / -0 |
Policies (4)
| Status | Policy | Material | Messages |
|---|---|---|---|
| ✅ Passed | ai-config-ai-agents-allowed |
ai-coding-session-119f62 |
- |
| ✅ Passed | ai-config-no-dangerous-commands |
ai-coding-session-119f62 |
- |
| ✅ Passed | ai-config-no-secrets |
ai-coding-session-119f62 |
- |
| ✅ Passed | ai-config-mcp-servers-allowed |
ai-coding-session-119f62 |
- |
Security Checks — ✅ 5 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
⏭️ 3 scans not applied
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
PR validation — ⚠️ 1 failing
| Status | Policy | Material | Messages |
|---|---|---|---|
| ✅ Passed | pr-min-approvals |
pr-info |
- |
| ✅ Passed | pr-description-required |
pr-info |
- |
pr-user-story-linked |
pr-info |
PR/MR #3464 does not reference a user story or issue in title, description, or branch 'fix(controlplane): confine legacy robot accounts to their bound workflow'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)[A-Z]{2", "}-[0-9]+", "(?i)gh-[0-9]+", "(?i)\[[A-Z]+-[0-9]+\]"] |
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
migmartri
approved these changes
Sep 24, 2026
Member
|
Is there a way to mint a token with workflow ID? |
Member
Author
Yes, and it was added recently #3116 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Legacy robot accounts are scoped to a single workflow, but the attestation handlers resolved the workflow from the request alone (project/workflow name, or run ID) and never compared it to the workflow encoded in the credential. Any robot account could therefore operate on every workflow in its organization through
GetContract,Init,StoreandCancel. Attestation endpoints are skipped by the authz middleware and RBAC is disabled for robot accounts, so the handler is the only authorization point on this path.This applies the binding in
findWorkflowFromTokenOrNameOrRunID, mirroring the check already in place for workflow-scoped API tokens and the equivalent one inAttestationStateService.usercontext.RobotAccountis a carrier shared with the API-token and federated middlewares, which populate it without a workflow. The binding is therefore conditional on a workflow being present, so those callers are unaffected.Robot accounts can no longer be issued and there is no revoke path left in the product, so existing credentials have to be confined by the handler.
AI assistance: this change was produced with Claude Code.