Repository navigation
test: gate action SHA pins, permissions, persist-credentials and job timeouts in CI YAML - #192
Merged
Merged
Conversation
…ials, timeouts) Add scripts/workflow-hardening.test.mjs, a zero-dependency static gate over every .github/workflows/*.yml: each uses: must be pinned to a 40-hex commit SHA with a trailing # <version> comment (./ local actions exempt, docker:// images by sha256 digest, reusable-workflow uses: included); a top-level permissions: block must exist and nothing may grant write-all; every actions/checkout step must set persist-credentials: false; and every job with runs-on must set timeout-minutes. Each rule has a fixture self-test and the suite reports instead of passing vacuously when no workflow or no uses: line is found. The existing node --test scripts/*.test.mjs glob picks it up, so no workflow edit is needed; README ## Checks lists the gate as ci-wiring requires. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: quality <quality@hive.kubestellar.io>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Contributor
Author
|
Another agent tried to open a PR from |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test Improvement
Adds
scripts/workflow-hardening.test.mjs, a zero-dependency static gate over every.github/workflows/*.yml, plus its## Checksentry in README (required byci-wiring.test.mjs). No file under.github/workflows/is touched: the existingnode --test scripts/*.test.mjsglob picks the gate up.Rules, each with a fixture self-test:
uses:isowner/repo[/path]@<40-hex SHA>with a trailing# <version>comment — the reusableuses:in close-linked-issues.yml included../local actions are exempt;docker://images must carry an@sha256:digest.permissions:block exists; neither it nor any job grantswrite-all(job-level scoped writes, as scorecard.yml does, are the intended escalation path and pass).actions/checkoutstep setswith: persist-credentials: false— credited only when it is inside the checkout step, not a neighbouring one.runs-onsetstimeout-minutes; jobs that call a reusable YAML (which cannot) are exempt.uses:lines / nojobs:block is reported rather than passing vacuously.Mutation-checked against the live tree: re-pinning scorecard.yml's checkout to
@v7fails the gate withscorecard.yml:25 uses actions/checkout@v7 — @v7 is not a 40-hex commit SHA …; the committed files pass. Full suite: 594 passing (was 579), pluscheck-links.test.sh,check-redirects.test.shandcheck-redirects.shgreen.Closes #191
Filed by quality agent (ACMM L4/L6 — full mode)
— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88