Fix/security reliability workflow hardening - #1251
Merged
Merged
Conversation
Pin all third-party (non-actions/, non-github/) actions across all workflows to full commit SHAs with a version comment, matching the existing pattern used for aquasecurity/trivy-action and trufflesecurity/trufflehog. Mitigates supply-chain risk from a compromised maintainer account silently repointing a mutable tag (@v4, @v12, etc.) to malicious code. Pinned: dtolnay/rust-toolchain, hashicorp/setup-terraform, aws-actions/configure-aws-credentials, bridgecrewio/checkov-action, docker/setup-buildx-action, docker/login-action, docker/metadata-action, docker/build-push-action, slackapi/slack-github-action, actions-rs/toolchain, softprops/action-gh-release, orhun/git-cliff-action, peter-evans/create-pull-request, codecov/codecov-action, returntocorp/semgrep-action, gitleaks/gitleaks-action.
The release workflow's changelog job used the default GITHUB_TOKEN (contents: write) to commit and git push origin HEAD:main directly, bypassing branch protection and any review step for an automated bot. Replace the direct push with peter-evans/create-pull-request, which opens changelog-update/<tag> against main instead. protect-changelog.yml is updated with a documented, narrowly-scoped exception so only that bot-authored PR branch is allowed through; every other PR that touches CHANGELOG.md is still blocked as before.
ROLLBACK.md documented predictiq-terraform-state / prod/terraform.tfstate
and environments/prod.tfvars, none of which exist. The real backend
config (infrastructure/terraform/environments/{production,staging}/backend.hcl)
uses predictiq-terraform-state-production and
predictiq-terraform-state-staging with production/terraform.tfstate and
staging/terraform.tfstate keys, and the real tfvars file is
environments/production/terraform.tfvars. Following the runbook verbatim
during a real incident would have targeted a non-existent bucket/key.
Updates all state-bucket commands, tfvars paths, and prod resource-id
references so the runbook is copy-paste runnable against the real
infrastructure, and adds a bucket/key reference table per environment.
None of the 14 workflows set a job-level timeout, so a hung step (e.g. cargo install cargo-audit / soroban-cli, or a stuck Terraform apply) would run until GitHub's 360-minute default, wasting runner minutes and, for deploy.yml, blocking the DynamoDB state lock for other environments in the max-parallel: 1 matrix. Add timeout-minutes to every job across all workflows (default 20). The Terraform apply job in deploy.yml and the cargo-audit install jobs in dependency-scan.yml and test.yml are tightened to 15 since they're the jobs most likely to hang and most costly to block on. Note: test.yml has a pre-existing YAML issue unrelated to this change (clippy/oracle-quality-gate jobs are missing a `with:` key before `components: clippy` on the pinned dtolnay/rust-toolchain step); left as-is since it predates this branch and is out of scope for these issues.
…e Rust toolchain action strategy, fix pre-existing broken with: blocks in test.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Conflict-resolved re-submission of #1227 (fork PR, no push access to update it directly). Reconciles the Rust-toolchain-action strategy with #1226 (already merged): switched to dtolnay/rust-toolchain pinned to a SHA, combining #1226's move away from the archived actions-rs/toolchain with #1227's SHA-pinning of third-party actions. Also fixes a pre-existing broken YAML block in test.yml (dangling with: keys from #1226) discovered while resolving conflicts. Closes #1227 in favor of this.