Skip to content

fix(ci): harden workflow supply-chain and injection surface #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
2233admin merged 2 commits into from
Jul 27, 2026
Merged

fix(ci): harden workflow supply-chain and injection surface #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5766ba5
fix(ci): harden workflow supply-chain and injection surface
2233admin Jul 26, 2026
4756d06
fix(test): match SHA-pinned checkout actions in layout test
2233admin Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 12 additions & 12 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,12 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
fetch-depth: 0

- name: Setup Python
uses: actions/setup-python@v5
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.14"

Expand Down Expand Up @@ -63,19 +63,19 @@ jobs:

- name: Rust check
shell: pwsh
run: cargo check
run: cargo check --locked

- name: Rust tests and core cross-contract gate
shell: pwsh
run: cargo test -p code-intel
run: cargo test -p code-intel --locked

- name: Representative project orientation benchmark
shell: pwsh
run: cargo test -p code-intel --test project_orientation_benchmark -- --nocapture
run: cargo test -p code-intel --locked --test project_orientation_benchmark -- --nocapture

- name: Build Rust CLI
shell: pwsh
run: cargo build -p code-intel --release
run: cargo build -p code-intel --release --locked

- name: Authoritative self-scan (release gate parity)
shell: pwsh
Expand Down Expand Up @@ -230,7 +230,7 @@ jobs:
run: ./tools/Test-BetaPackage.ps1 -ZipPath ./dist/code-intel-pipeline-windows-beta.zip -Json

- name: Upload package artifact
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: code-intel-pipeline-windows
path: |
Expand All @@ -254,12 +254,12 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
fetch-depth: 0

- name: Setup Python
uses: actions/setup-python@v5
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.14"

Expand Down Expand Up @@ -323,15 +323,15 @@ jobs:

- name: Rust check
shell: pwsh
run: cargo check
run: cargo check --locked

- name: Rust tests and core cross-contract gate
shell: pwsh
run: cargo test -p code-intel
run: cargo test -p code-intel --locked

- name: Build Rust CLI
shell: pwsh
run: cargo build -p code-intel --release
run: cargo build -p code-intel --release --locked

- name: Authoritative self-scan (release gate parity)
shell: pwsh
Expand Down
25 changes: 18 additions & 7 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,16 @@ on:

permissions:
contents: write
id-token: write
attestations: write

jobs:
release:
runs-on: windows-latest

steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
fetch-depth: 0

Expand All @@ -37,7 +39,7 @@ jobs:
}

- name: Setup Python
uses: actions/setup-python@v5
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.11"

Expand All @@ -55,23 +57,23 @@ jobs:

- name: Install ripgrep
shell: pwsh
run: choco install ripgrep -y --no-progress
run: choco install ripgrep --version 14.1.0 -y --no-progress

- name: Rust format
shell: pwsh
run: cargo fmt -p code-intel -- --check

- name: Rust check
shell: pwsh
run: cargo check
run: cargo check --locked

- name: Rust tests
shell: pwsh
run: cargo test -p code-intel
run: cargo test -p code-intel --locked

- name: Build Rust CLI
shell: pwsh
run: cargo build -p code-intel --release
run: cargo build -p code-intel --release --locked

- name: Authoritative self-scan (release blocking)
shell: pwsh
Expand Down Expand Up @@ -175,6 +177,11 @@ jobs:
& $packagedBinary sentrux --operation gate --repo $payload
if ($LASTEXITCODE -ne 0) { throw "packaged binary failed its own no-degradation gate" }

- name: Attest build provenance
uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
with:
subject-path: "dist/code-intel-pipeline-*-windows.zip"

- name: Create GitHub Release
shell: pwsh
env:
Expand All @@ -185,7 +192,11 @@ jobs:
$assets = @($asset, "$asset.sha256", "$asset.release-manifest.json")
gh release view $tag *> $null
if ($LASTEXITCODE -eq 0) {
gh release upload $tag @assets --clobber
# No --clobber: a leaked contents:write token must not be able to
# silently replace already-published release assets with no CI
# trail. If a re-run genuinely needs to replace assets for this
# tag, delete them deliberately (gh release delete-asset) first.
gh release upload $tag @assets
}
else {
$notes = "Code Intel Pipeline $tag."
Expand Down
22 changes: 14 additions & 8 deletions .github/workflows/skill-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,22 +10,28 @@ on:
- "install-code-intel-pipeline.ps1"
workflow_dispatch:

permissions:
contents: read

jobs:
# Run darwin-skill 8-dim scoring on every new/modified SKILL.md
score-skills:
name: Darwin score (8-dim)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
fetch-depth: 0
Comment on lines +22 to 24

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow relevant sections =="
cat -n .github/workflows/skill-check.yml | sed -n '1,230p'

echo
echo "== all checkout usages in workflow =="
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/skill-check.yml')
for i,line in enumerate(p.read_text().splitlines(),1):
    if 'uses: actions/checkout' in line:
        # print context up to 6 lines and check with block continuation
        start=max(1,i-2); end=min(p.read_text().count('\n'), i+4)
        print(f'--- {p}:{i} ---')
        for n,l in enumerate(p.read_text().splitlines(),1):
            if start <= n <= end:
                print(f'{n:4}: {l}')
PY

echo
echo "== action checkout persist-credentials default context search =="
rg -n "persist-credentials|checkout token|GITHUB_TOKEN|permissions:" .github/workflows/skill-check.yml

Repository: 2233admin/code-intel-pipeline

Length of output: 10791

🌐 Web query:

actions/checkout v4 persist-credentials default true README

💡 Result:

In the actions/checkout v4 action, the persist-credentials input defaults to true [1][2]. When persist-credentials is set to true (the default behavior), the authentication token or SSH key is persisted in the local Git configuration [3][4]. This allows subsequent scripts in your workflow to run authenticated Git commands [3][5]. The action ensures the token is removed during post-job cleanup [3]. If you wish to opt out of this behavior, you must explicitly set persist-credentials to false in your workflow file [3][4]: - uses: actions/checkout@v4 with: persist-credentials: false

Citations:

🌐 Web query:

GitHub Actions pull_request GITHUB_TOKEN permissions default read contents

💡 Result:

By default, the GITHUB_TOKEN used in GitHub Actions workflows is granted permissions based on settings configured at the repository, organization, or enterprise level [1]. Administrators can choose between two default permission configurations: 1. Permissive: The GITHUB_TOKEN has read/write access for all scopes [1][2]. 2. Restricted: The GITHUB_TOKEN only has read access for the contents and packages scopes [3][1]. When a workflow is triggered by a pull request from a forked repository, GitHub enforces stricter security measures [4][2]. In this scenario, the GITHUB_TOKEN is automatically downgraded to read-only access for all scopes [1][2], regardless of the default settings, unless specific administrative settings ("Send write tokens to workflows from pull requests") are enabled (which is not recommended for public forks due to security risks) [1][5]. The pull_request_target event is an exception to this automatic downgrade [5][6]. To follow the principle of least privilege, you can explicitly define the permissions required for your workflow or individual jobs using the permissions key in your YAML workflow file [7][2]. Any permissions not explicitly listed in this key are set to none [2]. Example configuration: permissions: contents: read pull-requests: write For more detailed control or cases where the GITHUB_TOKEN lacks sufficient permissions, you may need to use a personal access token (stored as a secret) or a GitHub App installation access token [7].

Citations:

Disable persisted checkout credentials in all checkout steps.

actions/checkout persists the workflow token by default, and subsequent steps execute repository-controlled code. Set persist-credentials: false on the three checkout usages; fetch-depth: 0 still supplies all needed history without leaving credentials in local Git config.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 22-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 1 file
  • .github/workflows/skill-check.yml#L22-L24 (this comment)
  • .github/workflows/skill-check.yml#L139-L139
  • .github/workflows/skill-check.yml#L160-L160
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/skill-check.yml around lines 22 - 24, Disable persisted
checkout credentials for all three actions/checkout steps in
.github/workflows/skill-check.yml at lines 22-24, 139-139, and 160-160 by adding
persist-credentials: false to each checkout configuration. Keep fetch-depth: 0
unchanged.

Sources: MCP tools, Linters/SAST tools


- name: Detect changed SKILL.md files
id: detect
env:
EVENT_NAME: ${{ github.event_name }}
BASE_REF: ${{ github.base_ref }}
run: |
if [ "${{ github.event_name }}" = "pull_request" ]; then
if [ "$EVENT_NAME" = "pull_request" ]; then
# PR — diff against base
git diff --name-only origin/${{ github.base_ref }}...HEAD \
git diff --name-only "origin/$BASE_REF"...HEAD \
| grep -E '(^|/)SKILL\.md$' > /tmp/changed_skills || true
else
# workflow_dispatch — scan all
Expand All @@ -39,10 +45,10 @@ jobs:
cat /tmp/changed_skills >> $GITHUB_OUTPUT
echo "EOF" >> $GITHUB_OUTPUT

- name: Setup Python + Anthropic SDK
- name: Setup Python + pinned deps
run: |
python -m pip install --upgrade pip
python -m pip install anthropic pyyaml
python -m pip install --require-hashes -r requirements-ci.txt
Comment on lines +48 to +51

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt =="
sed -n '1,90p' .github/workflows/skill-check.yml 2>/dev/null || true

echo
echo "== dependency files =="
git ls-files | rg '(^|/)(requirements.*\.txt|pyproject\.toml|poetry\.lock|Pipfile\.lock|uv\.lock|pip-tools|requirements_ci|requirements-ci\.txt)$' || true

echo
echo "== pip install occurrences =="
rg -n 'pip install|--upgrade pip|--require-hashes|requirements-ci\.txt' .github . -g '!node_modules' -g '!dist' -g '!build' || true

Repository: 2233admin/code-intel-pipeline

Length of output: 4439

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== requirements-ci.txt =="
cat -n requirements-ci.txt

echo
echo "== pip dependency declaration occurrences =="
rg -n '^[ \t]*(pip|pyyaml|yaml|anthropic|pytest)' requirements-ci.txt .github/workflows/skill-check.yml || true

echo
echo "== pip install commands with hashes nearby =="
python3 - <<'PY'
from pathlib import Path
import re
path = Path('requirements-ci.txt')
text = path.read_text()
for i,line in enumerate(text.splitlines(),1):
    s=line.strip()
    if not s or s.startswith('#'): continue
    if re.search(r'(--hash=|hash=)', s):
        print(f'{i}: {s}')
PY

Repository: 2233admin/code-intel-pipeline

Length of output: 2107

Do not install an unpinned pip version.

python -m pip install --upgrade pip runs before the hash-verified install and is not covered by requirements-ci.txt. Remove this upgrade or pin pip, including its hashes, in the trusted lock file.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/skill-check.yml around lines 48 - 51, Remove the unpinned
`python -m pip install --upgrade pip` command from the “Setup Python + pinned
deps” workflow step, leaving the hash-verified `requirements-ci.txt`
installation unchanged.

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
git ls-files ".github/workflows/*" || true

echo "== skill-check relevant sections =="
wc -l .github/workflows/skill-check.yml
sed -n '1,220p' .github/workflows/skill-check.yml

echo "== requirements manifests =="
for f in requirements-ci.txt requirements.txt pyproject.toml setup.py setup.cfg; do
  if [ -f "$f" ]; then echo "--- $f ---"; sed -n '1,220p' "$f"; fi
done

echo "== all pip install with require-hashes and requirements-ci.txt =="
rg -n "pip install --require-hashes -r requirements-ci.txt|pip install --require-hashes|requirements-ci\.txt" .

Repository: 2233admin/code-intel-pipeline

Length of output: 9647

Do not install the PR-supplied requirements-ci.txt in skill-check.yml.

Both pip install --require-hashes -r requirements-ci.txt steps load the manifest from the PR branch, so --require-hashes cannot prevent a changed manifest from installing modified dependencies. Install a trusted lock/manifest copy from the base branch or another immutable trusted source at both .github/workflows/skill-check.yml#L51 and .github/workflows/skill-check.yml#L164.

📍 Affects 1 file
  • .github/workflows/skill-check.yml#L51-L51 (this comment)
  • .github/workflows/skill-check.yml#L164-L164
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/skill-check.yml at line 51, Replace both
requirements-ci.txt installation steps at .github/workflows/skill-check.yml
lines 51 and 164 with installation from a trusted lock/manifest copied from the
base branch or another immutable trusted source; do not install the PR-supplied
requirements-ci.txt, while retaining hash verification for the trusted
dependency set.

Source: MCP tools


- name: Run darwin-skill 8-dim scoring
env:
Expand Down Expand Up @@ -130,7 +136,7 @@ jobs:
name: Link integrity check
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Check all .md files in /crates/code-nexus-lite/ have no broken links
run: |
Expand All @@ -151,11 +157,11 @@ jobs:
name: Frontmatter YAML validation
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

- name: Validate all SKILL.md frontmatter
run: |
python -m pip install pyyaml
python -m pip install --require-hashes -r requirements-ci.txt
python <<'PYEOF'
import sys, yaml, subprocess
from pathlib import Path
Expand Down
17 changes: 17 additions & 0 deletions requirements-ci.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# Hash-pinned Python dependency for .github/workflows/skill-check.yml
# (supply-chain-001). Installed with:
# pip install --require-hashes -r requirements-ci.txt
#
# Hashes cover the sdist plus manylinux x86_64 wheels for the CPython
# versions ubuntu-latest realistically ships (3.10-3.14). Regenerate by
# fetching https://pypi.org/pypi/PyYAML/json and pulling the sha256
# digests for the target version's sdist + manylinux2014_x86_64 wheels,
# or bump the version range here if ubuntu-latest's default Python moves
# outside cp310-cp314.
pyyaml==6.0.3 \
--hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
--hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
--hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
--hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
--hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
--hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5
2 changes: 1 addition & 1 deletion tests/test_repository_layout.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ def test_pipeline_workflows_checkout_complete_git_history(self) -> None:
text = (ROOT / ".github" / "workflows" / name).read_text(
encoding="utf-8"
)
checkout_count = text.count("uses: actions/checkout@v4")
checkout_count = text.count("uses: actions/checkout@")
self.assertGreater(checkout_count, 0)
self.assertEqual(text.count("fetch-depth: 0"), checkout_count)

Expand Down
Loading