ff-sec-actions is the shared security-evaluation platform for Filecoin
projects. It centralizes reusable GitHub workflows, composite actions,
Filecoin-aware review guidance, and the policy needed to interpret their
results.
The platform produces security evidence. It does not certify that a project is secure, and a green workflow only has meaning when every enabled evaluation completed its declared scope.
Project status: pre-v1. The repository is being hardened for ecosystem use. There is not yet a stable release. The scanner example now pins a transitively immutable execution graph, but use it only in pilot or sandbox repositories while the post-G0 evaluation, governance, and release gates are completed.
Start with the Consumer quickstart to choose a workflow, understand its authority, and interpret the first result.
- Copy the read-only Ecosystem Baseline
- Review every consumable workflow contract
- Choose a security profile
- Understand results and merge gates
- Configure permissions and secrets
Start with the Platform Maintainer guide before changing an action, workflow, prompt, profile, schema, or release reference.
Start with the Rollout Operator guide for pilot selection, policy, exceptions, health, and rollback.
The documentation home is the complete navigation index.
The machine-readable implementation roadmap shows the dependency-ordered work queue and the commands used to claim and complete work.
| Capability | Surface | Current status |
|---|---|---|
| Filecoin-aware AI PR review | Composite action and reusable workflow | Pilot; requires an Anthropic key |
| GitHub Actions security, Semgrep, CodeQL, Trivy, Gitleaks, dependency review, SBOM, Scorecard, Slither | Reusable workflows | Pilot; scanner behavior varies |
| Combined scanner suite | Umbrella reusable workflow | Pilot; transitively immutable at the example commit |
| Filecoin review invariants | Versioned prompts | Available to AI review |
| Ecosystem Security Profiles | Secretless Ecosystem Baseline | Consumer-testable alpha with one immutable pin |
| Path-scoped Filecoin project classification | Composite detector action and versioned profile catalog | Implemented pre-v1; immutable consumer pin pending release |
| Normalized Evaluation Result and Evidence Bundle | Five baseline evaluations plus Profile Conclusion |
Evaluation Result 1.1.0; Evidence Bundle 1.0.0 in the alpha baseline |
See the decision map for release gates and active design work.
.github/workflows/ reusable workflows and repository CI
actions/ composite actions and their implementation
docs/ consumer, maintainer, operator, and reference guides
examples/ executable consumer workflow examples
profiles/ versioned Filecoin Security Profile catalog
prompts/ shared and Filecoin-specific AI review guidance
scripts/ local tooling and documentation checks
roadmap/ canonical machine-readable implementation state
- The AI code-review action reads PR metadata and diffs through the GitHub API; it does not checkout or execute PR code.
- Scanner workflows checkout Consumer Project content. Baseline scanners do not execute project code; opt-in CodeQL and Slither may build or analyze project-controlled behavior. Review permissions and secrets before enabling them on untrusted PRs.
- Third-party GitHub actions and containers are immutable in the published graph. A consumer upgrades or rolls back by changing one reviewed commit.
- Fork PRs do not receive repository or organization secrets.
Do not put suspected vulnerability details or secrets in a public issue. A
formal private reporting route, SECURITY.md, and ownership policy are required
before public v1.