security: isolate dependency SARIF publication

Author: relotnek

.github/workflows/ecosystem-baseline.yml

@@ -41,7 +41,7 @@ jobs:
     permissions:
       actions: read
       contents: read
-    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-dependencies.yml@5b2da0e0fda3e9268b69a35451ca016f1b4d24ba
+    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-dependencies.yml@0644706f2dee239fe569d32219c1bba8c1069a0c
     with:
       blocking: ${{ inputs.dependency-blocking }}
       skip-dirs: ${{ inputs.skip-dirs }}

.github/workflows/evaluation-pipeline.yml

@@ -18,7 +18,7 @@ jobs:
   dependencies:
     permissions:
       contents: read
-    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-dependencies.yml@5b2da0e0fda3e9268b69a35451ca016f1b4d24ba
+    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-dependencies.yml@0644706f2dee239fe569d32219c1bba8c1069a0c
     with:
       blocking: ${{ inputs.dependency-blocking }}
 

.github/workflows/security-pipeline.yml

@@ -181,13 +181,33 @@ jobs:
     permissions:
       actions: read
       contents: read
-      security-events: write
-    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-dependencies.yml@5b2da0e0fda3e9268b69a35451ca016f1b4d24ba
+    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-dependencies.yml@0644706f2dee239fe569d32219c1bba8c1069a0c
     with:
       skip-dirs: ${{ inputs.skip-dirs }}
       blocking: ${{ inputs.dependency-blocking }}
       severity: ${{ inputs.dependency-severity }}
-      publish-sarif: ${{ inputs.publish-sarif }}
+
+  publish-dependency-sarif:
+    name: Publish Dependency SARIF
+    if: always() && inputs.enable-dependencies && inputs.publish-sarif
+    needs: dependencies
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Download Trivy dependency results
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: trivy-deps-results
+          path: trivy-deps-results
+
+      - name: Upload SARIF to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        with:
+          sarif_file: trivy-deps-results/trivy-deps.sarif
+          category: trivy-dependencies
 
   secrets-scan:
     if: inputs.enable-secrets

docs/reference/current-contracts.md

@@ -119,7 +119,7 @@ Evidence Bundle and `Profile Conclusion`. Its inputs are
 | `dependency-review-fail-on-severity` | `high` | Dependency-review threshold |
 | `dependency-blocking` | `false` | Fail on dependency findings; tool failure always fails |
 | `dependency-severity` | `CRITICAL,HIGH,MEDIUM` | Dependency findings included in the gate |
-| `publish-sarif` | `false` | Publish dependency SARIF using a separate write-authorized job |
+| `publish-sarif` | `false` | Privileged umbrella only: publish dependency SARIF in a separate write-authorized job |
 | `iac-blocking` | `false` | Fail on IaC findings; tool failure always fails |
 | `iac-severity` | `CRITICAL,HIGH,MEDIUM` | IaC findings included in the gate |
 | `license-blocking` | `false` | Fail on license findings; tool failure always fails |
@@ -174,7 +174,8 @@ The Ecosystem Baseline never reads `ENABLE_GHAS` and never requests
 `security-events: write`. The privileged full-suite example converts
 `ENABLE_GHAS='true'` into the explicit `publish-sarif` input; private repository
 product availability still applies. Dependency SARIF publication runs in a
-separate job so the inspection job remains read-only.
+separate privileged-umbrella job, outside the reusable inspection workflow, so
+the inspection permission envelope remains read-only.
 
 Possible permissions across the current workflows:
 

scripts/test-ecosystem-baseline.sh

@@ -46,17 +46,15 @@ grep -Fq "blocking: \${{ inputs.actions-security-blocking }}" "$workflow" \
 grep -Fq "blocking: \${{ inputs.actions-security-blocking }}" "$privileged_pipeline" \
   || fail "the privileged pipeline does not forward its workflow-definition gate"
 
-grep -Eq '^[[:space:]]+publish-sarif:[[:space:]]*$' "$dependencies_workflow" \
-  || fail "dependency evaluation does not expose explicit SARIF publication"
-grep -Eq '^  publish-sarif:[[:space:]]*$' "$dependencies_workflow" \
-  || fail "dependency SARIF publication is not isolated in its own job"
-grep -Fq "if: always() && inputs.publish-sarif" "$dependencies_workflow" \
-  || fail "dependency SARIF publication does not run after a finding gate fails"
-if grep -Fq "vars.ENABLE_GHAS" "$dependencies_workflow"; then
-  fail "dependency evaluation still inherits consumer repository publication state implicitly"
+if grep -Eq 'security-events:[[:space:]]+write|publish-sarif:' "$dependencies_workflow"; then
+  fail "dependency evaluation still mixes read-only inspection with SARIF publication"
 fi
-grep -Fq "publish-sarif: \${{ inputs.publish-sarif }}" "$privileged_pipeline" \
-  || fail "the privileged pipeline does not deliberately forward SARIF publication policy"
+grep -Eq '^  publish-dependency-sarif:[[:space:]]*$' "$privileged_pipeline" \
+  || fail "dependency SARIF publication is not isolated in the privileged pipeline"
+grep -Fq "if: always() && inputs.enable-dependencies && inputs.publish-sarif" "$privileged_pipeline" \
+  || fail "privileged dependency publication does not honor explicit consumer policy"
+grep -Fq "needs: dependencies" "$privileged_pipeline" \
+  || fail "privileged dependency publication is not ordered after inspection"
 if grep -Eq 'security-events:[[:space:]]+write|publish-sarif:' "$workflow" "$consumer_example"; then
   fail "the Ecosystem Baseline requests privileged SARIF publication"
 fi

security/workflow-policy.json

@@ -159,6 +159,12 @@
         }
       },
       "dependencies": {
+        "permissions": {
+          "actions": "read",
+          "contents": "read"
+        }
+      },
+      "publish-dependency-sarif": {
         "permissions": {
           "actions": "read",
           "contents": "read",