Move Transifex steps to separate workflow triggered by workflow_run

[hiciefte]

Secure Transifex Integration by Using workflow_run Trigger

This pull request moves the Transifex synchronization steps from the main build workflow (build.yml) to a separate workflow file, ensuring secure access to secrets and enhancing the security of our GitHub Actions workflows.

Background

Previously, the Transifex steps were included in the main build workflow triggered by pull_request events. However, workflows triggered by pull_request do not have access to secrets when the pull request originates from a forked repository. This limitation prevented the Transifex action from running successfully, as it requires access to the TX_TOKEN secret.

Using pull_request_target could have granted access to secrets, but it poses significant security risks. According to GitHub's security guidance, workflows triggered by pull_request_target can be exploited if untrusted code is executed, potentially exposing secrets or compromising the repository.

Solution

To address this issue securely, I have:

• Moved the Transifex steps to a separate workflow (sync_transifex.yml).
• Configured the new workflow to trigger on workflow_run events when the main build workflow (Build Bisq 2) completes successfully.
• Added a check to ensure the commit is part of the main branch, verifying that the pull request has been merged before running the Transifex steps.

By doing so, the Transifex workflow has access to the necessary secrets without exposing them to untrusted pull request code.

Security Considerations

This approach aligns with best practices recommended by GitHub to prevent potential security vulnerabilities:

• Avoids the use of pull_request_target for executing untrusted code with access to secrets.
• Ensures secrets are only accessible in workflows triggered by trusted events, such as workflow_run after merging into main.
• Prevents malicious actors from manipulating workflows to exfiltrate secrets or compromise the repository.

For more details on the security implications, please refer to GitHub's article on Keeping your GitHub Actions and workflows secure.