ci: harden GitHub Actions with permissions, SHA pins, and cache restrictions #154
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| # GitHub Actions Workflows | ||
|
|
||
| This directory contains CI/CD workflows for the agnix project. | ||
|
|
||
| ## Security Hardening | ||
|
|
||
| All workflows follow security best practices: | ||
|
|
||
| ### 1. Explicit Permissions | ||
|
|
||
| Every workflow declares minimum required permissions at the workflow level. | ||
| Jobs that need additional permissions declare them at the job level. | ||
|
|
||
| - `permissions: {}` - No permissions (used when jobs specify their own) | ||
| - `permissions: contents: read` - Read-only access to repository contents | ||
|
|
||
| ### 2. SHA-Pinned Actions | ||
|
|
||
| All third-party actions are pinned to specific commit SHAs to prevent | ||
| supply chain attacks. The SHA pins are documented with version comments | ||
| for maintainability. | ||
|
|
||
| ### 3. Cache Save Restrictions | ||
|
|
||
| Rust caches (`Swatinem/rust-cache`) are configured with `save-if` conditions | ||
| to only save caches on protected branches (main) or tag pushes. This prevents | ||
| cache poisoning from pull requests. | ||
|
|
||
| ## SHA Pin Reference | ||
|
|
||
| When updating actions, use these SHA commits (last verified: 2025-02): | ||
|
|
||
| ```yaml | ||
| # GitHub Official Actions | ||
| actions/checkout@v4: 34e114876b0b11c390a56381ad16ebd13914f8d5 | ||
| actions/upload-artifact@v4: ea165f8d65b6e75b540449e92b4886f43607fa02 | ||
| actions/download-artifact@v4: d3f86a106a0bac45b974a628896c90dbdf5c8093 | ||
|
|
||
| # Rust Tooling | ||
| dtolnay/rust-toolchain@stable: 4be9e76fd7c4901c61fb841f559994984270fce7 | ||
| Swatinem/rust-cache@v2: 779680da715d629ac1d338a641029a2f4372abb5 | ||
| taiki-e/install-action@v2: 650c5ca14212efbbf3e580844b04bdccf68dac31 | ||
| taiki-e/install-action@nextest: cd05dcd6eb73067dda063b97a15b7060049dacd9 | ||
|
|
||
| # Security | ||
| github/codeql-action@v3: 2588666de8825e1e9dc4e2329a4c985457d55b32 | ||
|
|
||
| # Release | ||
| softprops/action-gh-release@v2: a06a81a03ee405af7f2048a818ed3f03bbf83c7b | ||
|
|
||
| # Claude Code | ||
| anthropics/claude-code-action@v1: 6867bb3ab0b2c0a10629b6823e457347e74ad6d2 | ||
| ``` | ||
|
|
||
| ## Updating Action Versions | ||
|
|
||
| When a new version of an action is released: | ||
|
|
||
| 1. Check the release notes for security implications | ||
| 2. Get the full SHA of the release tag: | ||
| ```bash | ||
| git ls-remote --tags https://github.com/owner/repo refs/tags/vX.Y.Z | ||
| ``` | ||
| 3. Update all occurrences in workflow files | ||
| 4. Update this README with the new SHA | ||
| 5. Test the workflows on a feature branch before merging | ||
|
|
||
| ## Workflow Overview | ||
|
|
||
| | Workflow | Trigger | Purpose | | ||
| |----------|---------|---------| | ||
| | ci.yml | push/PR to main | Lint, test, build | | ||
| | release.yml | tag push (v*) | Build and publish releases | | ||
| | security.yml | push/PR/schedule | CodeQL analysis and security audit | | ||
| | test-action.yml | push/PR (action paths) | Test the GitHub Action | | ||
| | changelog.yml | PR | Verify CHANGELOG.md is updated | | ||
| | claude.yml | issue/PR comments | Claude Code assistant | | ||
| | claude-code-review.yml | PR | Automated code review | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -14,6 +14,9 @@ on: | |||||
| - '.github/workflows/test-action.yml' | ||||||
| workflow_dispatch: | ||||||
|
|
||||||
| permissions: | ||||||
| contents: read | ||||||
|
|
||||||
| jobs: | ||||||
| test-action: | ||||||
| name: Test (${{ matrix.os }}) | ||||||
|
|
@@ -24,12 +27,14 @@ jobs: | |||||
| os: [ubuntu-latest, macos-latest, windows-latest] | ||||||
|
|
||||||
| steps: | ||||||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | ||||||
|
|
||||||
| - name: Install Rust | ||||||
| uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable | ||||||
|
|
||||||
| - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 | ||||||
| with: | ||||||
| save-if: ${{ github.ref == 'refs/heads/main' }} | ||||||
|
There was a problem hiding this comment. The cache save restriction in test-action.yml only allows caching on the main branch, but this workflow is configured to run on feature/* and fix/* branches (see lines 5-9). This means builds on feature/* and fix/* branches will never be able to save caches, potentially slowing down development on these branches. Consider whether these branches should also be allowed to save caches, or if the trigger pattern should be restricted. The current configuration prevents cache poisoning but may impact developer experience on feature branches.
Suggested change
|
||||||
|
|
||||||
| - name: Test action (default inputs) | ||||||
| id: test-default | ||||||
|
|
@@ -167,15 +172,18 @@ jobs: | |||||
| name: Test SARIF Upload | ||||||
| runs-on: ubuntu-latest | ||||||
| permissions: | ||||||
| contents: read | ||||||
| security-events: write | ||||||
|
There was a problem hiding this comment.
The workflow now sets Useful? React with 👍 / 👎. |
||||||
|
|
||||||
| steps: | ||||||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | ||||||
|
|
||||||
| - name: Install Rust | ||||||
| uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable | ||||||
|
|
||||||
| - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2 | ||||||
| with: | ||||||
| save-if: ${{ github.ref == 'refs/heads/main' }} | ||||||
|
|
||||||
| - name: Run agnix with SARIF | ||||||
| id: agnix | ||||||
|
|
@@ -187,7 +195,7 @@ jobs: | |||||
|
|
||||||
| - name: Upload SARIF to GitHub | ||||||
| if: steps.agnix.outputs.sarif-file != '' | ||||||
| uses: github/codeql-action/upload-sarif@2588666de8825e1e9dc4e2329a4c985457d55b32 # v3 | ||||||
| with: | ||||||
| sarif_file: ${{ steps.agnix.outputs.sarif-file }} | ||||||
| continue-on-error: true | ||||||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The release.yml workflow uses a different cache save condition than described in the PR description. The description states "Restricted cache saves to main branch only" but release.yml correctly uses
startsWith(github.ref, 'refs/tags/')instead since it runs on tag pushes, not on main branch pushes. While the implementation is correct, the PR description could be more precise about this distinction.