mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
edf10769ac
Comprehensive CI/CD security hardening pass over all 33 workflows. Action pinning - Every `uses:` is now pinned to a 40-char commit SHA with a `# vX.Y.Z` comment alongside (167 occurrences resolved). Tag-style refs like `@v4` are mutable and have been used in past supply-chain attacks (e.g. tj-actions/changed-files in March 2025) to repoint widely-used actions to malicious commits. - Removed redundant `version: "10.13.1"` hardcodes from `pnpm/action-setup` call sites so the action inherits from package.json `packageManager` (one source of truth). Automated maintenance - Added `.github/dependabot.yml` for the `github-actions` ecosystem so SHA pins stay current. Without this, pins go stale fast and new upstream advisories never reach us. Minor/patch bumps are grouped; major bumps stay separate so they get a real review. Static analysis - Added `.github/zizmor.yml` configuration and `.github/workflows/security_zizmor.yml` (blocking on PR, runs on push to main, weekly schedule for advisory drift). zizmor catches the well-known classes of Actions footguns: template injection from untrusted input, dangerous triggers, unpinned uses, excessive token scopes, secret exfil patterns. - All 28 high-severity and 54 medium-severity findings from the baseline scan are remediated. Each suppression in zizmor.yml carries a per-finding justification comment so future maintainers can audit the trust assumption. Workflow hardening (from zizmor + manual audit) - Added `persist-credentials: false` to every `actions/checkout` except the 7 workflows that legitimately push back to the repo via the workflow token (release tagging, auto-formatting, docs-sync, registry updates). Each retained credential persistence carries a `persist-credentials required: ...` comment explaining the call site. - Routed every attacker-controllable expansion (`github.head_ref`, `github.event.pull_request.head.repo.full_name`, `inputs.*`, step outputs) through `env:` and referenced as quoted shell variables. Eliminates 17 template-injection vectors in fork-PR-reachable workflows. - Added per-job `permissions:` blocks across 14 workflows; demoted broad workflow-level `id-token: write` to the specific Depot-runner jobs that need it; narrowed `pull-requests: write` / `actions: write` to the jobs that actually call those APIs. Audit-driven fixes - `publish-release.yml` build job: dropped `token:` and added `persist-credentials: false`. The subsequent `Upload workspace` step was packing `.git/config` (with the persisted GITHUB_TOKEN) into a 1-day-retention artifact downloadable by anyone with `actions:read`. - `auto_merge_showcases.yml`: team-membership check now authorizes on the PR AUTHOR (`pull_request.user.login`), never `context.actor` — the actor is whoever triggered the latest event, so a team member synchronizing or reopening an outsider's PR would otherwise green-light auto-merge of code they didn't author. - `static_quality.yml`: pinned ruff to a specific version so a compromised release can't land on the next PR run with the persisted-credentials write token in the format job. - `showcase_capture-previews.yml`: switched the args-string construction to a bash array so a slug or demo value containing whitespace or shell metacharacters stays a single argument rather than being re-tokenized by the shell.
94 lines
3.3 KiB
YAML
94 lines
3.3 KiB
YAML
name: Auto-merge showcase PRs
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- "examples/showcases/**"
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
auto-merge:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check author is on Demo team
|
|
id: check-team
|
|
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
|
|
with:
|
|
# Authorize on the PR AUTHOR (immutable for the lifetime of the PR),
|
|
# never `context.actor` — `actor` is whoever triggered the most
|
|
# recent event, so a team member synchronizing or reopening an
|
|
# outsider's PR would otherwise green-light auto-merge of code
|
|
# they didn't author.
|
|
script: |
|
|
const prAuthor = context.payload.pull_request.user.login;
|
|
try {
|
|
await github.rest.teams.getMembershipForUserInOrg({
|
|
org: 'CopilotKit',
|
|
team_slug: 'demo',
|
|
username: prAuthor,
|
|
});
|
|
core.setOutput('is_demo', 'true');
|
|
} catch {
|
|
core.info(`${prAuthor} is not a member of CopilotKit/demo`);
|
|
core.setOutput('is_demo', 'false');
|
|
}
|
|
|
|
- name: Check PR only touches showcases
|
|
if: steps.check-team.outputs.is_demo == 'true'
|
|
id: check-files
|
|
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
|
|
with:
|
|
script: |
|
|
const { data: files } = await github.rest.pulls.listFiles({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: context.payload.pull_request.number,
|
|
per_page: 100,
|
|
});
|
|
|
|
const allShowcases = files.every(f =>
|
|
f.filename.startsWith('examples/showcases/')
|
|
);
|
|
|
|
if (!allShowcases) {
|
|
const outside = files
|
|
.filter(f => !f.filename.startsWith('examples/showcases/'))
|
|
.map(f => f.filename);
|
|
core.info(`Files outside showcases: ${outside.join(', ')}`);
|
|
}
|
|
|
|
core.setOutput('only_showcases', allShowcases.toString());
|
|
|
|
- name: Approve PR
|
|
if: steps.check-team.outputs.is_demo == 'true' && steps.check-files.outputs.only_showcases == 'true'
|
|
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
|
|
with:
|
|
script: |
|
|
await github.rest.pulls.createReview({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: context.payload.pull_request.number,
|
|
event: 'APPROVE',
|
|
body: 'Auto-approved: showcase-only changes from CopilotKit/demo team member.',
|
|
});
|
|
|
|
- name: Enable auto-merge
|
|
if: steps.check-team.outputs.is_demo == 'true' && steps.check-files.outputs.only_showcases == 'true'
|
|
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
|
|
with:
|
|
script: |
|
|
await github.graphql(`
|
|
mutation($prId: ID!) {
|
|
enablePullRequestAutoMerge(input: {
|
|
pullRequestId: $prId,
|
|
mergeMethod: MERGE
|
|
}) {
|
|
clientMutationId
|
|
}
|
|
}
|
|
`, { prId: context.payload.pull_request.node_id });
|