ci(security): phase-1 CI hardening — affected-area tests, least privilege, action pinning, dependency governance (#336 )

* ci(security): run deterministic eval tests in affected-area CI (Task 04)

The build-check job validated build + suite structure but never ran the
tests, and its summary referenced a `test:ci` script that did not exist.
Make affected-area CI meaningful:

- Add `test:ci` to evals/framework running the offline, deterministic
  Vitest allowlist (7 files / 112 tests) — no model, network, or paid
  execution.
- Add a required "Run deterministic tests" step to build-check; a failure
  fails the job and the existing PR summary gate (which keys on
  build-check.result) fails closed.
- Correct the summary note to state test:ci runs the deterministic
  allowlist and that model/network agent suites are excluded on PRs.

The broader deterministic suite has 3 pre-existing failing files
(framework-confidence, logger, test-runner; confirmed failing before this
work) which are intentionally out of the allowlist and tracked separately.

Validated locally: build, validate:suites:all, and test:ci all exit 0.

* ci(security): least privilege permissions + pin actions to SHAs (Task 05)

Harden all 9 GitHub Actions workflows:

Least privilege:
- Add explicit top-level `permissions: contents: read` to installer-checks,
  validate-test-suites, and opencode (opencode's job keeps the writes it
  needs; the top level now defaults to read).
- Every workflow now declares an explicit top-level permissions block.
- Write scopes retained only where justified (releases, doc/registry
  commits, follow-up PRs, and sync-docs' issues.create).

Immutable action pinning:
- Pin every `uses:` to a full 40-char commit SHA with a version comment,
  including first-party actions/* (checkout, github-script, setup-node,
  upload-artifact) and third-party (oven-sh/setup-bun).
- Replace the two mutable refs that could change under us at any push:
  ludeeus/action-shellcheck@master and sst/opencode/github@latest.

Record all SHAs, versions, and permission justifications in
docs/maintenance/repository-recovery/action-pin-inventory.md.

Verified: all 9 workflows parse as valid YAML; no floating tag/branch refs
remain; every workflow has a top-level permissions block.

* docs(security): add SECURITY.md and private-reporting checklist (Task 06)

- Add root SECURITY.md: supported versions (0.7.x), private reporting via
  GitHub's "Report a vulnerability", best-effort response expectations,
  coordinated disclosure, and no-secret guidance.
- Add private-vulnerability-reporting checklist that separates repository
  file work (this PR) from GitHub settings changes that require their own
  approval (Task 07: enabling private vulnerability reporting).

No external links to validate; the reporting path uses the repo Security
tab. SECURITY.md documents the private reporting path ahead of Task 07
enabling it.

* ci(security): add dependency governance and ownership controls (Task 08)

- .github/dependabot.yml: weekly grouped github-actions updates (keeps the
  Task 05 SHA pins current). Scoped to actions only — the primary lockfile
  is bun.lock and Dependabot's npm ecosystem would desync it; npm
  dependency risk is covered by dependency-review below.
- .github/workflows/dependency-review.yml: runs on PRs with contents: read,
  SHA-pinned actions, fail-on-severity: high to block newly introduced
  high-severity vulnerabilities (exceptions documented inline).
- .github/CODEOWNERS: default owner @darrenhinde with explicit ownership of
  security-sensitive paths (workflows, dependabot, CODEOWNERS, SECURITY.md,
  scripts/validation).

Verified: dependabot.yml and dependency-review.yml are valid YAML;
dependency-review actions are SHA-pinned with contents: read; CODEOWNERS
owner is the repository owner.

* docs(security): record GitHub security settings evidence (Task 07)

Enable private vulnerability reporting and record read-back evidence.

Settings changed (each approved immediately before, verified by read-back):
- Private vulnerability reporting: enabled=false -> enabled=true. The
  Security tab now offers "Report a vulnerability", making the path
  documented in SECURITY.md live.
- Dependency Graph / Dependabot alerts: 404 -> 204. This was an
  undocumented prerequisite of Task 08's dependency-review.yml, which
  failed with "Dependency graph is not enabled"; the Dependency Review
  check on PR #336 went fail -> pass after enabling it.

No other repository setting was modified; secret scanning and push
protection are unchanged, and dependabot_security_updates remains disabled
(out of scope, would need its own approval). Both changes are reversible
via the corresponding DELETE calls.

Marks Part B of the private-vulnerability-reporting checklist complete.

2026-07-15 00:19:28 +01:00

2.7 KiB

Raw Blame History

GitHub Security Settings — Change Evidence

Repository-recovery Task 07 (private vulnerability reporting), plus the Dependency Graph prerequisite discovered during Task 08. Repository: darrenhinde/OpenAgentsControl (public). Date: 2026-07-15.

Each change below was explicitly approved immediately before it was made, and verified by read-back. No other repository setting was modified.

Change 1 — Dependency Graph / Dependabot alerts (Task 08 prerequisite)

Discovered while adding dependency-review.yml: the Dependency Review action fails with "Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled" unless the Dependency Graph is on.

Step	Command	Result
Before	`GET /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts`	`HTTP 404` (disabled)
Enable	`PUT /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts`	`HTTP 204`
Read-back	`GET /repos/darrenhinde/OpenAgentsControl/vulnerability-alerts`	`HTTP 204` (enabled)

Verification: the Dependency Review check on PR #336 went from fail (4s, "Dependency graph is not enabled") to pass (9s) after this change.

Change 2 — Private vulnerability reporting (Task 07)

Makes the reporting path documented in SECURITY.md live.

Step	Command	Result
Before	`GET /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting`	`{"enabled": false}`
Enable	`PUT /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting`	`HTTP 204`
Read-back	`GET /repos/darrenhinde/OpenAgentsControl/private-vulnerability-reporting`	`{"enabled": true}`

Verification: the repository Security tab now offers Report a vulnerability, so the path documented in SECURITY.md resolves.

Settings not changed

Confirmed unchanged before and after (GET /repos/{owner}/{repo} → security_and_analysis):

{
  "dependabot_security_updates": { "status": "disabled" },
  "secret_scanning": { "status": "enabled" },
  "secret_scanning_non_provider_patterns": { "status": "disabled" },
  "secret_scanning_push_protection": { "status": "enabled" },
  "secret_scanning_validity_checks": { "status": "disabled" }
}

Note: dependabot_security_updates (automated fix PRs) remains disabled — it was not in scope for Task 07 and would require its own approval. Dependabot alerts are now on via the Dependency Graph change above; .github/dependabot.yml is scoped to github-actions updates only.

Reversal

Both changes are reversible with the corresponding DELETE calls:

DELETE /repos/{owner}/{repo}/private-vulnerability-reporting
DELETE /repos/{owner}/{repo}/vulnerability-alerts

2.7 KiB Raw Blame History