Harden GitHub Actions execution and improve workflows#150
Open
roark47 wants to merge 7 commits into
Open
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository’s CI/CD and GitHub Action supply chain by moving untrusted execution onto GitHub-hosted runners, minimizing permissions, pinning third-party dependencies (actions, images, installers), and documenting operational runbooks for maintainers.
Changes:
- Tighten workflow security posture (least-privilege permissions, SHA-pinned actions, improved concurrency, safer shell defaults, and clearer secret handling).
- Improve action/runtime supply-chain integrity (digest-pinned runner image, version-pinned tools, and checksum-verified installer download paths).
- Add maintainer documentation plus ownership/dependency automation updates (CI maintenance runbook, CODEOWNERS, Dependabot, actionlint labels).
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| docs/zh/guide/ci-maintenance.md | Adds Chinese CI maintenance runbook covering trust boundaries, required checks, secrets/environments, and incident guidance. |
| docs/guide/ci-maintenance.md | Adds English CI maintenance runbook aligning repo settings with hardened workflows. |
| docs/.vitepress/config.ts | Adds “Maintainers/维护者” nav entries linking to the new CI maintenance docs. |
| action/main.py | Pins installer source + validates installer checksum before execution; pins default skill-up version. |
| action/entry.sh | Hardens shell execution (-euo pipefail) and makes workspace permission restoration fail loudly. |
| action/Dockerfile | Pins base image by digest; pins tool versions; replaces mutable installers with checksum-verified artifacts; adds OCI labels. |
| action.yml | Pins default skill-up version and pins runner image by digest. |
| .github/workflows/workflow-security.yml | Introduces a workflow to scan workflows with Zizmor using least-privilege permissions. |
| .github/workflows/skill-upper-self-eval.yml | Tightens permissions, runner labeling, secret handling, and avoids copying secrets via step outputs. |
| .github/workflows/runner-image.yml | Hardens image publishing workflow (permissions, tag validation, build metadata, SBOM/provenance, digest recording). |
| .github/workflows/release.yml | Adds concurrency + release tag validation; tightens permissions and runner labeling; pins GoReleaser version. |
| .github/workflows/extended-ci.yml | Moves untrusted Windows E2E to GitHub-hosted; pins tool installs; hard-fails on missing required secrets; pins Docker images by digest. |
| .github/workflows/docs.yml | Adds PR docs builds on GitHub-hosted runners; restricts deploy steps/permissions to non-PR events. |
| .github/workflows/codeql.yml | Moves CodeQL to GitHub-hosted runners; pins actions; adds merge_group; tightens permissions and shell robustness. |
| .github/workflows/ci.yml | Adds merge_group; moves core CI jobs to GitHub-hosted runners; minimizes permissions; improves concurrency semantics. |
| .github/dependabot.yml | Adds npm + Docker Dependabot updates with grouping/labels for easier review. |
| .github/CODEOWNERS | Updates guidance and expands ownership coverage for workflows/action/dependabot. |
| .github/actionlint.yaml | Documents self-hosted runner custom labels for actionlint validation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1f450ef80d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request makes significant improvements to CI/CD security, reliability, and maintainability by updating workflow configurations, permissions, and dependency management. The main changes include switching most jobs from persistent self-hosted runners to ephemeral GitHub-hosted runners, tightening job permissions, improving dependency pinning, and enhancing secret handling. There are also updates to code ownership and Dependabot configuration.
CI/CD Workflow Hardening and Improvements
ci.yml,codeql.yml,docs.yml,extended-ci.yml) now default to using GitHub-hosted runners (e.g.,ubuntu-24.04,windows-2025) for untrusted or PR code, reducing risk from untrusted code execution. Only trusted jobs use self-hosted runners with required labels. [1] [2] [3] [4] [5] [6] [7] [8] [9]permissions: {}globally, with jobs opting into only what they need), following the principle of least privilege. [1] [2] [3] [4]set -euo pipefailis added to shell steps for more robust error handling. [1] [2] [3] [4] [5] [6] [7] [8]Dependency and Toolchain Management
extended-ci.ymlare now pinned to specific versions for reproducibility and reliability. [1] [2]npm) and Docker dependencies, with grouping and labeling for easier review.Code Ownership and Runner Labeling
dependabot.yml, and the action source.actionlint.yamlfor self-hosted runners.Other Notable Improvements
.github/CODEOWNERSfile is updated to reflect recommended rulesets and stable checks.These changes collectively make the CI/CD pipeline more secure, maintainable, and reliable, and ensure best practices are followed for dependency and secret management.