mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Alem Tuzlak
edf10769ac
Comprehensive CI/CD security hardening pass over all 33 workflows. Action pinning - Every `uses:` is now pinned to a 40-char commit SHA with a `# vX.Y.Z` comment alongside (167 occurrences resolved). Tag-style refs like `@v4` are mutable and have been used in past supply-chain attacks (e.g. tj-actions/changed-files in March 2025) to repoint widely-used actions to malicious commits. - Removed redundant `version: "10.13.1"` hardcodes from `pnpm/action-setup` call sites so the action inherits from package.json `packageManager` (one source of truth). Automated maintenance - Added `.github/dependabot.yml` for the `github-actions` ecosystem so SHA pins stay current. Without this, pins go stale fast and new upstream advisories never reach us. Minor/patch bumps are grouped; major bumps stay separate so they get a real review. Static analysis - Added `.github/zizmor.yml` configuration and `.github/workflows/security_zizmor.yml` (blocking on PR, runs on push to main, weekly schedule for advisory drift). zizmor catches the well-known classes of Actions footguns: template injection from untrusted input, dangerous triggers, unpinned uses, excessive token scopes, secret exfil patterns. - All 28 high-severity and 54 medium-severity findings from the baseline scan are remediated. Each suppression in zizmor.yml carries a per-finding justification comment so future maintainers can audit the trust assumption. Workflow hardening (from zizmor + manual audit) - Added `persist-credentials: false` to every `actions/checkout` except the 7 workflows that legitimately push back to the repo via the workflow token (release tagging, auto-formatting, docs-sync, registry updates). Each retained credential persistence carries a `persist-credentials required: ...` comment explaining the call site. - Routed every attacker-controllable expansion (`github.head_ref`, `github.event.pull_request.head.repo.full_name`, `inputs.*`, step outputs) through `env:` and referenced as quoted shell variables. Eliminates 17 template-injection vectors in fork-PR-reachable workflows. - Added per-job `permissions:` blocks across 14 workflows; demoted broad workflow-level `id-token: write` to the specific Depot-runner jobs that need it; narrowed `pull-requests: write` / `actions: write` to the jobs that actually call those APIs. Audit-driven fixes - `publish-release.yml` build job: dropped `token:` and added `persist-credentials: false`. The subsequent `Upload workspace` step was packing `.git/config` (with the persisted GITHUB_TOKEN) into a 1-day-retention artifact downloadable by anyone with `actions:read`. - `auto_merge_showcases.yml`: team-membership check now authorizes on the PR AUTHOR (`pull_request.user.login`), never `context.actor` — the actor is whoever triggered the latest event, so a team member synchronizing or reopening an outsider's PR would otherwise green-light auto-merge of code they didn't author. - `static_quality.yml`: pinned ruff to a specific version so a compromised release can't land on the next PR run with the persisted-credentials write token in the format job. - `showcase_capture-previews.yml`: switched the args-string construction to a bash array so a slug or demo value containing whitespace or shell metacharacters stays a single argument rather than being re-tokenized by the shell.
35 lines
909 B
YAML
35 lines
909 B
YAML
name: cleanup / pr-caches
|
|
on:
|
|
pull_request:
|
|
types:
|
|
- closed
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
pr-caches:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
# Needed to delete repository actions caches via `gh cache delete`
|
|
actions: write
|
|
steps:
|
|
- name: Cleanup
|
|
run: |
|
|
echo "Fetching list of cache key"
|
|
cacheKeysForPR=$(gh cache list --ref $BRANCH --limit 100 --json id --jq '.[].id')
|
|
|
|
## Setting this to not fail the workflow while deleting cache keys.
|
|
set +e
|
|
echo "Deleting caches..."
|
|
for cacheKey in $cacheKeysForPR
|
|
do
|
|
gh cache delete $cacheKey
|
|
done
|
|
echo "Done"
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GH_REPO: ${{ github.repository }}
|
|
BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge
|