699b2d7769
* ci(security): run deterministic eval tests in affected-area CI (Task 04) The build-check job validated build + suite structure but never ran the tests, and its summary referenced a `test:ci` script that did not exist. Make affected-area CI meaningful: - Add `test:ci` to evals/framework running the offline, deterministic Vitest allowlist (7 files / 112 tests) — no model, network, or paid execution. - Add a required "Run deterministic tests" step to build-check; a failure fails the job and the existing PR summary gate (which keys on build-check.result) fails closed. - Correct the summary note to state test:ci runs the deterministic allowlist and that model/network agent suites are excluded on PRs. The broader deterministic suite has 3 pre-existing failing files (framework-confidence, logger, test-runner; confirmed failing before this work) which are intentionally out of the allowlist and tracked separately. Validated locally: build, validate:suites:all, and test:ci all exit 0. * ci(security): least privilege permissions + pin actions to SHAs (Task 05) Harden all 9 GitHub Actions workflows: Least privilege: - Add explicit top-level `permissions: contents: read` to installer-checks, validate-test-suites, and opencode (opencode's job keeps the writes it needs; the top level now defaults to read). - Every workflow now declares an explicit top-level permissions block. - Write scopes retained only where justified (releases, doc/registry commits, follow-up PRs, and sync-docs' issues.create). Immutable action pinning: - Pin every `uses:` to a full 40-char commit SHA with a version comment, including first-party actions/* (checkout, github-script, setup-node, upload-artifact) and third-party (oven-sh/setup-bun). - Replace the two mutable refs that could change under us at any push: ludeeus/action-shellcheck@master and sst/opencode/github@latest. Record all SHAs, versions, and permission justifications in docs/maintenance/repository-recovery/action-pin-inventory.md. Verified: all 9 workflows parse as valid YAML; no floating tag/branch refs remain; every workflow has a top-level permissions block. * docs(security): add SECURITY.md and private-reporting checklist (Task 06) - Add root SECURITY.md: supported versions (0.7.x), private reporting via GitHub's "Report a vulnerability", best-effort response expectations, coordinated disclosure, and no-secret guidance. - Add private-vulnerability-reporting checklist that separates repository file work (this PR) from GitHub settings changes that require their own approval (Task 07: enabling private vulnerability reporting). No external links to validate; the reporting path uses the repo Security tab. SECURITY.md documents the private reporting path ahead of Task 07 enabling it. * ci(security): add dependency governance and ownership controls (Task 08) - .github/dependabot.yml: weekly grouped github-actions updates (keeps the Task 05 SHA pins current). Scoped to actions only — the primary lockfile is bun.lock and Dependabot's npm ecosystem would desync it; npm dependency risk is covered by dependency-review below. - .github/workflows/dependency-review.yml: runs on PRs with contents: read, SHA-pinned actions, fail-on-severity: high to block newly introduced high-severity vulnerabilities (exceptions documented inline). - .github/CODEOWNERS: default owner @darrenhinde with explicit ownership of security-sensitive paths (workflows, dependabot, CODEOWNERS, SECURITY.md, scripts/validation). Verified: dependabot.yml and dependency-review.yml are valid YAML; dependency-review actions are SHA-pinned with contents: read; CODEOWNERS owner is the repository owner. * docs(security): record GitHub security settings evidence (Task 07) Enable private vulnerability reporting and record read-back evidence. Settings changed (each approved immediately before, verified by read-back): - Private vulnerability reporting: enabled=false -> enabled=true. The Security tab now offers "Report a vulnerability", making the path documented in SECURITY.md live. - Dependency Graph / Dependabot alerts: 404 -> 204. This was an undocumented prerequisite of Task 08's dependency-review.yml, which failed with "Dependency graph is not enabled"; the Dependency Review check on PR #336 went fail -> pass after enabling it. No other repository setting was modified; secret scanning and push protection are unchanged, and dependabot_security_updates remains disabled (out of scope, would need its own approval). Both changes are reversible via the corresponding DELETE calls. Marks Part B of the private-vulnerability-reporting checklist complete.
53 lines
3.2 KiB
Markdown
53 lines
3.2 KiB
Markdown
# GitHub Actions Pin & Permissions Inventory
|
|
|
|
_Repository-recovery Task 05 — least privilege + immutable action pinning._
|
|
_Resolved: 2026-07-15._
|
|
|
|
## Third-party / external action pins
|
|
|
|
Every `uses:` reference is pinned to a full 40-character commit SHA, with the
|
|
human-readable version retained as a trailing comment. SHAs were resolved via
|
|
`gh api repos/<owner>/<repo>/commits/<ref>` on the date above.
|
|
|
|
| Action | Previous ref | Pinned SHA | Note |
|
|
|--------|--------------|------------|------|
|
|
| `actions/checkout` | `@v4` (19 uses) | `34e114876b0b11c390a56381ad16ebd13914f8d5` | GitHub-owned |
|
|
| `actions/github-script` | `@v7` (6 uses) | `f28e40c7f34bde8b3046d885e986cb6290c5673b` | GitHub-owned |
|
|
| `actions/setup-node` | `@v4` (3 uses) | `49933ea5288caeca8642d1e84afbd3f7d6820020` | GitHub-owned |
|
|
| `actions/upload-artifact` | `@v4` (1 use) | `ea165f8d65b6e75b540449e92b4886f43607fa02` | GitHub-owned |
|
|
| `oven-sh/setup-bun` | `@v2` (1 use) | `0c5077e51419868618aeaa5fe8019c62421857d6` | Matches the SHA already pinned by the other usage |
|
|
| `ludeeus/action-shellcheck` | `@master` (1 use) | `00b27aa7cb85167568cb48a3838b75f4265f2bca` | **Was a mutable branch ref** — highest risk before pinning |
|
|
| `sst/opencode/github` | `@latest` (1 use) | `77fc88c8ade8e5a620ebbe1197f3a572d29ae91a` | **Was a mutable ref** — freezes the OpenCode agent version; update deliberately |
|
|
|
|
### Update guidance
|
|
|
|
To bump a pinned action later: re-resolve the desired tag to its SHA
|
|
(`gh api repos/<owner>/<repo>/commits/<tag> --jq .sha`), replace the SHA, and
|
|
update the trailing version comment in the same edit. Never revert a pin back to
|
|
a floating tag or branch.
|
|
|
|
## Workflow permissions (least privilege)
|
|
|
|
Every workflow now declares an explicit top-level `permissions:` block. Default
|
|
is `contents: read`; write scopes remain only where a job demonstrably needs them.
|
|
|
|
| Workflow | Top-level | Job-level writes | Justification |
|
|
|----------|-----------|------------------|---------------|
|
|
| `pr-checks.yml` | `contents: read` | — | read-only validation |
|
|
| `validate-registry.yml` | `contents: read` | — | read-only validation |
|
|
| `installer-checks.yml` | `contents: read` **(added)** | — | shellcheck / installer tests, read-only |
|
|
| `validate-test-suites.yml` | `contents: read` **(added)** | — | suite validation, read-only |
|
|
| `opencode.yml` | `contents: read` **(added)** | `id-token`, `contents`, `pull-requests`, `issues: write` (job) | `/oc` agent, gated to OWNER/MEMBER; job needs write to act on PRs/issues |
|
|
| `create-release.yml` | `contents: write` | — | creates tags/releases |
|
|
| `post-merge-pr.yml` | `contents: write`, `pull-requests: write` | — | opens follow-up PRs |
|
|
| `sync-docs.yml` | `contents: write`, `pull-requests: write`, `issues: write` | — | commits doc branch, opens PR, creates a sync issue (`issues.create`) |
|
|
| `update-registry.yml` | `contents: write` | — | commits registry updates |
|
|
|
|
`issues: write` in `sync-docs.yml` is retained because the workflow calls
|
|
`github.rest.issues.create` to open a sync-tracking issue.
|
|
|
|
## Verification
|
|
|
|
- All 9 workflow files parse as valid YAML.
|
|
- No `uses:` reference remains on a floating tag or branch — all are 40-char SHAs.
|
|
- Every workflow has an explicit top-level `permissions:` block.
|