Check username-ID mapping before each run

[typed-sigterm]

The username is mutable. For security reasons, we may need a username-ID snapshot like uv.lock, which is generated by cli and checked before each run. If it does not match, raise an error to inform users to update usernames and re-generate snapshot.

[typed-sigterm]

Maybe the org/team IDs should also be included in the snapshot

[mxmehl]

Interesting thought, thanks. What would be the attack vector this would mitigate?

My understanding: john1 renames themselves to john2. This is exploited by a malicious actor who registers a new user under john1 or renames an existing one.

Is this even possible with GitHub, or are usernames reserved forever?

[typed-sigterm]

IIRC GitHub reserve the usernames for 90 days. In many cases, the previous usernames will redirect to the new, including some APIs. So it might work for years until a malicious actor gets the username.

[typed-sigterm]

I think it should get more design: if lockfile mismatch, CI should fail early. But the only chance to update the lockfile is running gh-org-mgr while it's not currently aimed to run locally. The solutions may be:

1. Recommend gh-org-mgr add to add users and update lockfile locally
2. Directly let users write IDs instead of usernames, and optionally provide converting command like gh-org-mgr pin to avoid manually query IDs in the browser
3. Check if requested username == responded username, fail if not

I think (3) is the most graceful one... to keep simple. It won't work if the workflow isn't scheduled to run in the 90 days.