Merge pull request #31 from naipi11/codex/release-dependabot-token

Harden release Dependabot alert gate

Author: naipi11

.github/CI.md

@@ -49,6 +49,15 @@ tag; it uses only the repository `GITHUB_TOKEN`, never a PAT. Release notes
 mark the build as unsigned when no Authenticode certificate was supplied.
 Winget submission is a separate, manual step outside this workflow.
 
+The Dependabot release gate uses the repository secret
+`DEPENDABOT_ALERTS_TOKEN`, not `GITHUB_TOKEN`: GitHub's automatic Actions
+token cannot reliably read the Dependabot alerts REST endpoint. Configure it
+as a fine-grained token restricted to this repository with **Dependabot
+alerts: Read** permission, then rotate it using `gh secret set
+DEPENDABOT_ALERTS_TOKEN -R naipi11/codex-barbar`. A missing or unreadable
+secret fails the release before artifacts are built; there is no release-time
+bypass for that security gate.
+
 ### Interaction guard — `.github/workflows/interaction-guard.yml`
 
 Runs on `ubuntu-24.04` for untrusted issue/PR authors. Permissions are

.github/workflows/pr-check.yml

@@ -80,6 +80,10 @@ jobs:
         shell: pwsh
         run: .\scripts\assert-v1-boundaries.ps1
 
+      - name: Release workflow policy guard
+        shell: pwsh
+        run: .\scripts\assert-release-workflow.ps1
+
       - name: Production dependency audit
         run: pnpm --dir apps/desktop-tauri audit --prod --audit-level high
 

.github/workflows/release.yml

@@ -12,11 +12,6 @@ on:
         required: false
         default: false
         type: boolean
-      allow_unreadable_dependabot:
-        description: Allow a manual release when the Dependabot API is unavailable (requires external alert review)
-        required: false
-        default: false
-        type: boolean
   push:
     tags:
       - 'v*'
@@ -104,30 +99,32 @@ jobs:
         shell: pwsh
         run: .\scripts\audit-licenses.ps1
 
+      - name: Release workflow policy guard
+        shell: pwsh
+        run: .\scripts\assert-release-workflow.ps1
+
       - name: Dependabot alert gate
         shell: pwsh
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }}
         run: |
-          $allowUnreadable = $false
-          if ($env:GITHUB_EVENT_NAME -eq 'workflow_dispatch') {
-            $allowUnreadable = [bool]::Parse("${{ inputs.allow_unreadable_dependabot }}")
+          if ([string]::IsNullOrWhiteSpace($env:GH_TOKEN)) {
+            throw "DEPENDABOT_ALERTS_TOKEN is not configured. Add a repository secret with Dependabot alerts: Read."
           }
-          $alerts = gh api "/repos/$env:GITHUB_REPOSITORY/dependabot/alerts" --paginate 2>$null
+
+          $alertsJson = gh api "/repos/$env:GITHUB_REPOSITORY/dependabot/alerts?state=open&per_page=100" --paginate --slurp 2>$null
           if ($LASTEXITCODE -ne 0) {
-            if (-not $allowUnreadable) {
-              throw "Dependabot alerts API is not readable. Enable Dependabot alerts / security-events read access before publishing."
-            }
-            Write-Warning "Dependabot alerts API is unavailable; manual override was explicitly supplied after external alert review."
-            $global:LASTEXITCODE = 0
-          } else {
-            $critical = @($alerts | ConvertFrom-Json | Where-Object {
-              $_.state -eq 'open' -and $_.security_advisory.severity -in @('high', 'critical')
-            })
-            if ($critical.Count -gt 0) {
-              $names = $critical | ForEach-Object { $_.dependency.package.ecosystem + ':' + $_.dependency.package.name } | Sort-Object -Unique
-              throw "Open high/critical Dependabot alerts block release: $($names -join ', ')"
-            }
+            throw "Dependabot alerts API is not readable with DEPENDABOT_ALERTS_TOKEN."
+          }
+
+          $pages = @($alertsJson | ConvertFrom-Json)
+          $alerts = @($pages | ForEach-Object { $_ })
+          $critical = @($alerts | Where-Object {
+            $_.state -eq 'open' -and $_.security_advisory.severity -in @('high', 'critical')
+          })
+          if ($critical.Count -gt 0) {
+            $names = $critical | ForEach-Object { $_.dependency.package.ecosystem + ':' + $_.dependency.package.name } | Sort-Object -Unique
+            throw "Open high/critical Dependabot alerts block release: $($names -join ', ')"
           }
 
       - name: Build release artifacts

scripts/assert-release-workflow.ps1

@@ -0,0 +1,47 @@
+# Static policy guard for the release workflow.
+#
+# Dependabot's alerts endpoint is not reliably readable through the automatic
+# Actions GITHUB_TOKEN. A dedicated repository secret is mandatory, otherwise
+# tag-triggered releases would fail after all build checks had already passed.
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$workflowPath = Join-Path $repoRoot '.github\workflows\release.yml'
+if (-not (Test-Path -LiteralPath $workflowPath)) {
+    throw "Release workflow is missing: $workflowPath"
+}
+
+$workflow = Get-Content -Raw -Encoding utf8 -LiteralPath $workflowPath
+$gateMatch = [regex]::Match(
+    $workflow,
+    '(?ms)^      - name: Dependabot alert gate\r?\n.*?(?=^      - name:|\z)'
+)
+if (-not $gateMatch.Success) {
+    throw 'Release workflow has no Dependabot alert gate.'
+}
+
+$gate = $gateMatch.Value
+$required = @(
+    'GH_TOKEN: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }}',
+    'DEPENDABOT_ALERTS_TOKEN is not configured',
+    '/repos/$env:GITHUB_REPOSITORY/dependabot/alerts'
+)
+foreach ($fragment in $required) {
+    if (-not $gate.Contains($fragment)) {
+        throw "Dependabot gate must contain: $fragment"
+    }
+}
+
+if ($gate.Contains('GITHUB_TOKEN')) {
+    throw 'Dependabot gate must not use the automatic GITHUB_TOKEN.'
+}
+if ($workflow.Contains('allow_unreadable_dependabot')) {
+    throw 'Release workflow must not allow an unreadable Dependabot bypass.'
+}
+if ($gate.Contains('manual override')) {
+    throw 'Dependabot gate must not contain a manual override path.'
+}
+
+Write-Host '[assert-release-workflow] OK - Dependabot release credential policy is enforced'

scripts/local-check.ps1

@@ -56,6 +56,7 @@ if (-not ($Rust -or $Tauri -or $Frontend -or $Format -or $Clippy -or $ReleaseDoc
 Push-Location $RepoRoot
 try {
     Invoke-Step "V1 boundary guard" "powershell.exe" @("-NoProfile", "-ExecutionPolicy", "Bypass", "-File", "scripts\assert-v1-boundaries.ps1")
+    Invoke-Step "Release workflow policy guard" "powershell.exe" @("-NoProfile", "-ExecutionPolicy", "Bypass", "-File", "scripts\assert-release-workflow.ps1")
     if ($All -or $Format) {
         Invoke-Step "Rust format" "cargo" @("fmt", "--all", "--check")
     }