ci(security): add the CodeQL and dependency-update wiring this repo lacked - #13
Open
forkwright wants to merge 1 commit into
Open
ci(security): add the CodeQL and dependency-update wiring this repo lacked#13forkwright wants to merge 1 commit into
forkwright wants to merge 1 commit into
Conversation
…acked Nothing was reading this repo's source for injection paths, unsafe patterns, or over-broad workflow permissions. cargo audit, cargo deny and OSV all read the dependency list rather than the code, so a defect written here was never scanned. Dependabot coverage matters for the same reason its absence is quiet: a repo with no config receives no update PRs at all, and the symptom is silence rather than a failing job. Scope follows what the repo actually is rather than a uniform template. A repo with no Cargo manifest gets the workflow-definition scan only -- a Rust scan there fails looking for a build, on every push, forever -- and its dependabot config declares only the ecosystems it uses. Every CodeQL job carries a timeout. Without one a hung run reaches GitHub's six-hour default, which is the failure nobody notices until it has been burning minutes all afternoon, and it is the specific thing the fleet template omits. The checkout pin matches what this repo's own workflows already use rather than the newest available, because introducing a second version of one action into a repo is the drift this wiring exists to catch. Scheduled weekly rather than per-PR, so it adds no latency to the merge path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finding
Nothing reads this repo's source for injection paths, unsafe patterns, or over-broad workflow permissions.
cargo audit,cargo denyand OSV all read the dependency list, not the code — so a defect written here has never been scanned.Where a dependabot config was also missing: a repo with no config receives no update PRs at all, and the symptom is silence rather than a failing job. That is how a dependency goes years without a bump while every dashboard looks fine.
Scope follows what this repo actually is
Not a uniform template. The rule applied:
analyze-actions(the workflow definitions themselves: untrusted input reaching arunblock, permissions wider than needed) andanalyze-rust(the crate source).analyze-actionsonly. A Rust scan on a repo with no crates fails looking for a build, on every push, forever — the fleet standard names this failure explicitly.cargowhere a root manifest exists,github-actionswhere workflows exist,npmwhere apackage.jsonexists (none of these repos have one — checked, root and subdirectories).Two details that are deliberate
Every CodeQL job carries
timeout-minutes. Without one, a hung run reaches GitHub's six-hour default — the failure nobody notices until it has been burning minutes all afternoon. This is the specific thing the fleet template in kanon is missing, which is why these were sourced from aletheia's live copy rather than from the template.The
actions/checkoutpin matches what this repo's own workflows already use, not the newest available. Introducing a second version of one action into a single repo is exactly the drift this wiring exists to catch. Where a repo had no local precedent at all, the fleet-canonical pin was used.Free on a public repository, and scheduled weekly rather than per-PR, so it adds no latency to the merge path.