ci: simplify final security builder and expose PR trigger

Author: niakw

.github/workflows/final-security-hardening-once.yml

@@ -1,10 +1,10 @@
 name: Final security hardening builder
 
 on:
-  push:
+  pull_request:
     branches: [main]
     paths:
-      - ".github/workflows/final-security-hardening-once.yml"
+      - ".github/triggers/final-security-hardening"
   workflow_dispatch:
 
 permissions:
@@ -21,271 +21,16 @@ jobs:
           ref: chore/final-security-hardening
           fetch-depth: 0
 
-      - name: Apply reviewed security hardening
-        shell: bash
-        run: |
-          set -euo pipefail
-          python3 - <<'PY'
-          from pathlib import Path
-
-          root = Path('.')
-
-          worker_path = root / 'scripts/provider_worker.cjs'
-          worker = worker_path.read_text(encoding='utf-8')
-          old_restrictions = '''function installModuleRestrictions() {
-            const blocked = new Set([
-              'child_process', 'node:child_process', 'cluster', 'node:cluster',
-              'worker_threads', 'node:worker_threads', 'inspector', 'node:inspector',
-              'repl', 'node:repl', 'vm', 'node:vm', 'module', 'node:module',
-            ]);
-            const originalLoad = Module._load;
-            Module._load = function restrictedLoad(request, parent, isMain) {
-              if (blocked.has(String(request))) throw new Error(`provider module blocked: ${request}`);
-              return originalLoad.call(this, request, parent, isMain);
-            };
-          }
-          '''
-          new_restrictions = '''const BLOCKED_PROVIDER_MODULES = new Set([
-            'child_process', 'cluster', 'worker_threads', 'inspector', 'repl', 'vm', 'module',
-            'fs', 'fs/promises', 'http', 'https', 'http2', 'net', 'tls', 'dgram',
-            'dns', 'dns/promises', 'process', 'wasi', 'sqlite', 'v8',
-          ]);
-
-          function canonicalProviderModule(request) {
-            const value = String(request || '').trim();
-            return value.startsWith('node:') ? value.slice(5) : value;
-          }
-
-          function blockedProviderModule(request) {
-            return BLOCKED_PROVIDER_MODULES.has(canonicalProviderModule(request));
-          }
-
-          function installModuleRestrictions() {
-            const originalLoad = Module._load;
-            Module._load = function restrictedLoad(request, parent, isMain) {
-              if (blockedProviderModule(request)) throw new Error(`provider module blocked: ${request}`);
-              return originalLoad.call(this, request, parent, isMain);
-            };
-
-            if (typeof process.getBuiltinModule === 'function') {
-              const originalGetBuiltinModule = process.getBuiltinModule.bind(process);
-              const restrictedGetBuiltinModule = (request) => {
-                if (blockedProviderModule(request)) throw new Error(`provider module blocked: ${request}`);
-                return originalGetBuiltinModule(request);
-              };
-              try {
-                Object.defineProperty(process, 'getBuiltinModule', {
-                  value: restrictedGetBuiltinModule,
-                  configurable: true,
-                  writable: false,
-                });
-              } catch {
-                try { process.getBuiltinModule = restrictedGetBuiltinModule; } catch {}
-              }
-            }
-          }
-
-          function assertProviderSourcePolicy(sourceText) {
-            const patterns = [
-              /\\b(?:require|import)\\s*\\(\\s*['\"`]([^'\"`]+)['\"`]\\s*\\)/g,
-              /\\b(?:from|import)\\s+['\"`]([^'\"`]+)['\"`]/g,
-              /\\bprocess\\s*\\.\\s*getBuiltinModule\\s*\\(\\s*['\"`]([^'\"`]+)['\"`]\\s*\\)/g,
-            ];
-            for (const pattern of patterns) {
-              for (const match of String(sourceText || '').matchAll(pattern)) {
-                const request = match[1];
-                if (blockedProviderModule(request)) {
-                  throw new Error(`provider module blocked by source policy: ${request}`);
-                }
-              }
-            }
-          }
-          '''
-          if old_restrictions not in worker:
-              raise SystemExit('provider worker restriction anchor changed')
-          worker = worker.replace(old_restrictions, new_restrictions, 1)
-          old_loader = '''async function loadProvider(filePath) {
-            installModuleRestrictions();
-            try {
-              return require(filePath);
-          } catch (requireError) {
-          '''
-          new_loader = '''async function loadProvider(filePath) {
-            const sourceText = fs.readFileSync(filePath, 'utf8');
-            assertProviderSourcePolicy(sourceText);
-            installModuleRestrictions();
-            try {
-              return require(filePath);
-          } catch (requireError) {
-          '''
-          if old_loader not in worker:
-              raise SystemExit('provider worker loader anchor changed')
-          worker = worker.replace(old_loader, new_loader, 1)
-          worker_path.write_text(worker, encoding='utf-8')
-
-          health_path = root / 'scripts/health_check.mjs'
-          health = health_path.read_text(encoding='utf-8')
-          old_spawn = '''    const child = spawn(process.execPath, [
-                `--max-old-space-size=${workerMemoryMb}`,
-                WORKER_PATH,
-                providerPath,
-          '''
-          new_spawn = '''    const child = spawn(process.execPath, [
-                `--max-old-space-size=${workerMemoryMb}`,
-                '--permission',
-                `--allow-fs-read=${path.join(ROOT, 'scripts')}`,
-                `--allow-fs-read=${path.join(ROOT, 'node_modules')}`,
-                `--allow-fs-read=${path.join(ROOT, 'package.json')}`,
-                `--allow-fs-read=${STAGE}`,
-                WORKER_PATH,
-                providerPath,
-          '''
-          if old_spawn not in health:
-              raise SystemExit('health worker spawn anchor changed')
-          health = health.replace(old_spawn, new_spawn, 1)
-          health_path.write_text(health, encoding='utf-8')
-
-          security_test = r'''#!/usr/bin/env node
-          'use strict';
-          const assert = require('node:assert');
-          const fs = require('node:fs');
-          const os = require('node:os');
-          const path = require('node:path');
-          const { spawnSync } = require('node:child_process');
-          const root = path.resolve(__dirname, '..');
-          const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'nuvio-worker-security-'));
-          const fixture = JSON.stringify({tmdbId:'1',mediaType:'movie',title:'Test'});
-          const context = JSON.stringify({locale:'fr-FR',networkLimits:{maxFetches:1}});
-
-          function runProvider(source) {
-            const provider = path.join(dir, `provider-${Math.random().toString(16).slice(2)}.cjs`);
-            fs.writeFileSync(provider, source);
-            return spawnSync(process.execPath,[path.join(root,'scripts/provider_worker.cjs'),provider,fixture,context],{cwd:root,encoding:'utf8'});
-          }
-
-          for (const request of ['node:child_process','node:fs','node:https','node:net','node:dns']) {
-            const result = runProvider(`module.exports={getStreams(){require('${request}');return []}}`);
-            assert.match(result.stdout, new RegExp(`provider module blocked: ${request.replace(/[.*+?^${}()|[\\]\\]/g,'\\$&')}`));
-          }
-
-          if (typeof process.getBuiltinModule === 'function') {
-            const result = runProvider(`module.exports={getStreams(){process.getBuiltinModule('fs');return []}}`);
-            assert.match(result.stdout, /provider module blocked(?: by source policy)?: fs/);
-          }
-
-          {
-            const result = runProvider(`module.exports={async getStreams(){await import('node:http');return []}}`);
-            assert.match(result.stdout, /provider module blocked by source policy: node:http/);
-          }
-
-          {
-            const result = runProvider(`const cheerio=require('cheerio-without-node-native');module.exports={getStreams(){const $=cheerio.load('<div>ok</div>');if($('div').text()!=='ok')throw new Error('parser failed');return []}}`);
-            assert.strictEqual(result.status, 0, result.stderr || result.stdout);
-            assert.match(result.stdout, /NUVIO_HEALTH_RESULT=/);
-          }
-
-          console.log('provider worker security tests passed');
-          '''
-          # Remove indentation introduced by the Python raw string formatting.
-          security_test = '\n'.join(line[10:] if line.startswith('          ') else line for line in security_test.splitlines()) + '\n'
-          (root / 'tests/provider_worker_security.test.cjs').write_text(security_test, encoding='utf-8')
-
-          workflow_test = r'''#!/usr/bin/env python3
-          from __future__ import annotations
-
-          import re
-          from pathlib import Path
-
-          ROOT = Path(__file__).resolve().parents[1]
-          WORKFLOWS = ROOT / '.github' / 'workflows'
-          SHA = re.compile(r'^[0-9a-f]{40}$', re.IGNORECASE)
-          USES = re.compile(r'^\s*(?:-\s*)?uses:\s*([^\s#]+)', re.MULTILINE)
-          errors: list[str] = []
-
-          for path in sorted([*WORKFLOWS.glob('*.yml'), *WORKFLOWS.glob('*.yaml')]):
-              text = path.read_text(encoding='utf-8')
-              rel = path.relative_to(ROOT)
-              if re.search(r'^\s*pull_request_target\s*:', text, re.MULTILINE):
-                  errors.append(f'{rel}: pull_request_target is forbidden')
-              if re.search(r'^\s*permissions\s*:\s*write-all\s*$', text, re.MULTILINE):
-                  errors.append(f'{rel}: permissions write-all is forbidden')
-              if 'permissions:' not in text:
-                  errors.append(f'{rel}: explicit permissions are required')
-              for match in USES.finditer(text):
-                  value = match.group(1).strip('"\'')
-                  if value.startswith('./'):
-                      continue
-                  if value.startswith('docker://'):
-                      if '@sha256:' not in value:
-                          errors.append(f'{rel}: Docker action/image must be digest-pinned: {value}')
-                      continue
-                  if '@' not in value:
-                      errors.append(f'{rel}: action/ref missing immutable pin: {value}')
-                      continue
-                  _action, ref = value.rsplit('@', 1)
-                  if not SHA.fullmatch(ref):
-                      errors.append(f'{rel}: external action must use full commit SHA: {value}')
-
-          if errors:
-              raise SystemExit('workflow security policy failed:\n- ' + '\n- '.join(errors))
-          print('workflow security policy tests passed')
-          '''
-          workflow_test = '\n'.join(line[10:] if line.startswith('          ') else line for line in workflow_test.splitlines()) + '\n'
-          (root / 'tests/workflow_security_policy_test.py').write_text(workflow_test, encoding='utf-8')
-
-          codeowners = '''# Default ownership keeps review routing explicit for every repository change.
-          * @niakw
-
-          # Security- and publication-sensitive surfaces.
-          /.github/ @niakw
-          /engine_v2/ @niakw
-          /scripts/ @niakw
-          /tests/ @niakw
-          /provider_catalog.json @niakw
-          /provider-overrides.json @niakw
-          /manifest.json @niakw
-          /vf/manifest.json @niakw
-          /package.json @niakw
-          /package-lock.json @niakw
-          /SECURITY.md @niakw
-          '''
-          codeowners = '\n'.join(line[10:] if line.startswith('          ') else line for line in codeowners.splitlines()) + '\n'
-          (root / '.github' / 'CODEOWNERS').write_text(codeowners, encoding='utf-8')
-
-          dep_path = root / '.github/workflows/dependency-gate.yml'
-          dep = dep_path.read_text(encoding='utf-8')
-          dep = dep.replace(
-              '      - name: Verify upgraded runtime imports\n        run: node -e "require(\'axios\'); require(\'cheerio\'); console.log(\'dependency imports ok\')"\n',
-              '      - name: Audit non-optional production dependencies\n        run: npm audit --audit-level=high --omit=optional\n\n      - name: Verify upgraded runtime imports\n        run: node -e "require(\'axios\'); require(\'cheerio\'); console.log(\'dependency imports ok\')"\n',
-              1,
-          )
-          dep = dep.replace('          import subprocess\n          from pathlib import Path\n', '          import shlex\n          import subprocess\n          from pathlib import Path\n', 1)
-          dep = dep.replace('              subprocess.run(command, shell=True, check=True)\n', '              subprocess.run(shlex.split(command), check=True)\n', 1)
-          dep_path.write_text(dep, encoding='utf-8')
-
-          actions_path = root / '.github/workflows/github-actions-gate.yml'
-          actions = actions_path.read_text(encoding='utf-8')
-          actions = actions.replace('      - ".github/workflows/**"\n', '      - ".github/workflows/**"\n      - "tests/workflow_security_policy_test.py"\n', 1)
-          actions = actions.replace('          python3 tests/ci_preservation_policy_test.py\n', '          python3 tests/workflow_security_policy_test.py\n          python3 tests/ci_preservation_policy_test.py\n', 1)
-          actions_path.write_text(actions, encoding='utf-8')
-
-          export_path = root / '.github/workflows/provider-status-export.yml'
-          export = export_path.read_text(encoding='utf-8')
-          export = export.replace("    types: [completed]\n", "    types: [completed]\n    branches: [main]\n", 1)
-          export_path.write_text(export, encoding='utf-8')
-
-          security_path = root / 'SECURITY.md'
-          security = security_path.read_text(encoding='utf-8').rstrip() + '''\n\n## Repository and runtime hardening\n\nGitHub Actions use explicit least-privilege permissions and immutable full-length action SHAs. A repository policy test rejects `pull_request_target`, `write-all`, mutable external Action refs, and unpinned Docker action images. `CODEOWNERS` routes all changes — especially workflows, publication state, scripts and security controls — to the repository owner for review.\n\nThe provider worker is a defense-in-depth compatibility sandbox: it receives a reduced environment, blocks process spawning plus direct filesystem/network-capable Node modules, filters `process.getBuiltinModule`, rejects static dangerous imports, and is launched by health checks under Node's Permission Model with read-only access limited to the worker scripts, dependencies and staged provider inputs. Provider network access must go through the guarded `fetch` surface so SSRF, redirect, host-count and response-size limits remain effective. This still does not claim perfect hostile-code isolation; OS/container isolation remains the stronger long-term boundary.\n\nThe dependency gate installs the committed lockfile with lifecycle scripts disabled, checks high-severity advisories for the non-optional production tree, and runs the deterministic repository suite. The legacy `cheerio-without-node-native` package remains intentionally pinned because published upstream bundles still import it; replacing it requires provider compatibility evidence rather than a blind dependency substitution.\n\nFor a potentially sensitive vulnerability, avoid publishing exploit details in a normal public issue. Prefer GitHub private vulnerability reporting when available for the repository, or contact the repository owner privately.\n'''
-          security_path.write_text(security, encoding='utf-8')
-          PY
+      - name: Materialize reviewed hardening
+        run: python3 scripts/build_final_security_hardening_once.py
 
-      - name: Validate generated proposal locally
+      - name: Validate generated proposal
         shell: bash
         run: |
           set -euo pipefail
           node tests/provider_worker_security.test.cjs
           python3 tests/workflow_security_policy_test.py
-          python3 -m py_compile scripts/validate_platform_runtime_policy.py tests/workflow_security_policy_test.py
+          python3 -m py_compile scripts/build_final_security_hardening_once.py tests/workflow_security_policy_test.py
           git diff --check
 
       - name: Build proposal commit