CI hardening#1839
Merged
Merged
Conversation
blotus
commented
Jul 7, 2026
blotus
commented
Member
- Pin actions SHA
- Least privileges on workflows
- No creds persistence
- Remove 3rd party actions
- Enable dependabot for actions
Pin every previously float-tagged action (checkout, setup-uv, setup-python, gh-find-current-pr, actions-comment-pull-request, configure-aws-credentials, yq) to a full commit SHA with a version comment, matching the already-pinned workflows. configure-aws-credentials is moved off the deprecated v1 (Node 16) to v4.3.1. The three single-maintainer actions still on float tags (nelonoel/branch-name, ad-m/github-push-action, schneegans/dynamic-badges-action) are inlined in a later commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add explicit permissions blocks so every job runs on a minimal GITHUB_TOKEN instead of the default broad scope: - contents: read for all lint/test/validate workflows - contents: write for the workflows that push commits back (update-index, update-blockers, update_taxonomy) - pull-requests: write only where a PR comment is posted (appsec_vpatch_lint, update_taxonomy) - actions: write only on the waf-check "run" job (deletes artifacts) The already-scoped invalidate-cache jobs (id-token/contents) are left as-is. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Set persist-credentials: false on every checkout that doesn't push, so GITHUB_TOKEN isn't left in .git/config for later steps. Left untouched on the three checkouts that git-push back (update-index, update-blockers, update_taxonomy's build job): those rely on the persisted token for the push. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drop three single-maintainer action dependencies in favour of inline steps: - nelonoel/branch-name -> BRANCH_NAME derived from github.ref_name via env - ad-m/github-push-action -> plain `git push` using the persisted token (update-index, update-blockers, update_taxonomy) - schneegans/dynamic-badges-action -> inline `gh api` PATCH of the badge gist. For test_appsec_rules the badge is built on the host runner; for test_configurations (tests run in the crowdsec:dev container, which has no jq/gh) coverage is exported as job outputs and a new host-side update-badges job pushes the gist. Also fixes the parsers badge using the scenario colour, and guards the badge updates with a repository_owner check so forks don't push. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- lint-python: trigger on master, not main (the default branch is master, so the Python lint never ran on PRs) - lint.yml: path filter referenced lint.yaml; the file is lint.yml, so edits to the workflow itself didn't trigger it - disambiguate the two workflows both named "Lint" -> "Lint Index" and "Lint Python" Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Keep the newly pinned action SHAs current: weekly github-actions updates, with minor/patch bumps grouped into a single PR so review stays low-noise (major bumps still open individually). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Make all workflows pass actionlint cleanly: - quote $GITHUB_SHA / $GITHUB_ENV / $ITEM / $HOME (SC2086) - tr -d '[[:space:]]' -> '[:space:]' (SC2021: the double brackets delete literal '[', ':' ... not the whitespace class) - drop the "./" prefix on an appsec_vpatch_lint path filter (a leading "./" never matches GitHub's path-filter globs, so that entry was dead) - remove the unused current_pwd assignment in waf-check (SC2034) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
startsWith(a, b) tests whether a starts with b, so
startsWith('refs/heads/v', github.ref) was backwards: it never matched
real v* release branches (only 'master' worked, via the || clause).
Swap the arguments so taxonomy push and the cache invalidations fire on
release branches as intended.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Update all first/vendor-party actions we keep to their current release (SHA-pinned, comment refreshed): - actions/checkout v5.0.0 -> v7.0.0 - actions/setup-go v6.0.0 -> v6.5.0 - actions/setup-python v6.0.0 -> v6.3.0 - actions/upload-artifact v4.6.2 -> v7.0.1 - actions/download-artifact v5.0.0 -> v8.0.1 - astral-sh/setup-uv v7.1.2 -> v8.3.1 - aws-actions/configure-aws-credentials v4.3.1 -> v6.2.1 - golangci/golangci-lint-action v9.2.0 -> v9.3.0 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Remove four more third-party action dependencies: - mikefarah/yq -> `go install github.com/mikefarah/yq/v4@v4.53.3` (version-pinned, integrity-checked via the Go module checksum DB; Go is already on the runner and used for the jv install in the same job). Split loop rewritten as find -print0 | while read (SC2044). - geekyeggo/delete-artifact -> `gh api` DELETE of the run's dataset artifact (tolerates the concurrent matrix deletes). - jwalton/gh-find-current-pr + thollander/actions-comment-pull-request -> a single `gh pr comment` step that resolves the branch's open PR and posts the error file (skips cleanly when there is no PR). Only actions/*, github/* and the two vendor actions (astral-sh/setup-uv, golangci/golangci-lint-action) remain. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Hardens GitHub Actions CI workflows by pinning action references to SHAs, tightening default permissions, avoiding third‑party actions where possible, and adding Dependabot updates for GitHub Actions.
Changes:
- Added explicit
permissionsblocks and setpersist-credentials: falseon many checkouts. - Replaced third-party helper actions (badge updates, PR commenting, artifact deletion, branch-name detection, push action) with
ghCLI and native git commands. - Added
.github/dependabot.ymlto track GitHub Actions dependency updates weekly.
Reviewed changes
Copilot reviewed 12 out of 13 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/waf-check.yaml | Pins actions, adds permissions, disables credential persistence, replaces artifact deletion action with gh api. |
| .github/workflows/validate.yml | Pins checkout, disables credential persistence, replaces yq action usage with go install + local execution. |
| .github/workflows/update-index.yml | Pins actions and replaces third-party branch/push actions with direct git commands; adds workflow permissions. |
| .github/workflows/update-blockers.yml | Pins actions and replaces third-party branch/push actions with direct git commands; pins AWS credentials action. |
| .github/workflows/update_taxonomy.yaml | Pins actions, replaces third-party PR comment/push actions with gh + git; tightens permissions. |
| .github/workflows/test_configurations.yaml | Pins checkout; replaces dynamic-badges action with gh api gist patching using job outputs. |
| .github/workflows/test_appsec_rules.yaml | Pins actions, disables credential persistence, replaces dynamic-badges action with gh api gist patching. |
| .github/workflows/lint.yml | Pins actions, disables credential persistence, updates path filter to match renamed workflow filename. |
| .github/workflows/lint-python.yaml | Pins actions, disables credential persistence, adds permissions, updates branch filters, renames workflow. |
| .github/workflows/lint-index.yml | Pins actions, disables credential persistence, adds permissions, renames workflow. |
| .github/workflows/appsec_vpatch_lint.yaml | Pins actions, disables credential persistence, replaces third-party PR comment action with gh CLI. |
| .github/dependabot.yml | Enables weekly Dependabot updates for GitHub Actions with grouped minor/patch updates. |
Re-enabling lint-python (it previously ran on the non-existent `main` branch) surfaced 6 pre-existing ruff findings in scenario_taxonomy.py. Extend that module's existing per-file-ignores block with the four stylistic rules involved (EM101, FURB122, PLR0915, TRY003), matching how every other cshub module is already handled. No behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Hello @blotus, ✅ The new VPATCH Rule is compliant, thank you for your contribution! |
|
Hello @blotus, Scenarios/AppSec Rule are compliant with the taxonomy, thank you for your contribution! |
The push trigger had path filters but no branch filter, so it fired on a push to any branch (including PR/feature branches) and auto-committed blockers.json back to that branch. Restrict it to master and v* release branches, matching the invalidate-cache job's guard. The schedule is unaffected (it only runs on the default branch anyway). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.