From 7572e7d545fa42aff74a81852d1c978888d0a45e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 11 Sep 2026 10:48:46 +0100 Subject: [PATCH 1/2] fix(ci): apply foundation CI/CD security fixes - Update CodeQL workflow to SHA-pinned actions with persist-credentials: false - Update reusable workflow pins to current standards main SHAs Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/dependabot.yml | 1 + .github/workflows/codeql.yml | 8 +++++--- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/scorecard.yml | 2 +- robot-repo-automaton/.github/dependabot.yml | 4 ++++ 6 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 690b8821..3642ab23 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,7 @@ updates: actions: patterns: - "*" + open-pull-requests-limit: 2 # Rust dependencies. Keep every Cargo project in one update entry so the # open-PR limit applies to the fleet as a whole, rather than once per bot. diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c9703681..94324102 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -44,15 +44,17 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.8 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.8 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index cc2965a5..671ad26c 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -34,4 +34,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd # main 2026-06-27 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f31a5a4ba591d544b65f91f6d78b136e07756f0 # main 2026-06-27 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 6798fb6d..111a63cc 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -30,7 +30,7 @@ permissions: jobs: hypatia: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@cc58c0cb23f73fc2019ce85a56a468e5248a93b3 secrets: inherit # Total caller-side wall-clock cap for the reusable. Matches # Hypatia's `missing_timeout_minutes` rule expectation. The scan is diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 833b2c87..e86c9dc1 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -15,5 +15,5 @@ jobs: permissions: security-events: write id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8750b94ac1bbe8c51ad13fe106669b13478f0b62 secrets: inherit diff --git a/robot-repo-automaton/.github/dependabot.yml b/robot-repo-automaton/.github/dependabot.yml index 2f80405e..e41f2659 100644 --- a/robot-repo-automaton/.github/dependabot.yml +++ b/robot-repo-automaton/.github/dependabot.yml @@ -8,6 +8,7 @@ updates: actions: patterns: - "*" + open-pull-requests-limit: 2 - package-ecosystem: "cargo" directory: "/" @@ -16,13 +17,16 @@ updates: ignore: - dependency-name: "*" update-types: ["version-update:semver-patch"] + open-pull-requests-limit: 0 - package-ecosystem: "npm" directory: "/" schedule: interval: "daily" + open-pull-requests-limit: 3 - package-ecosystem: "pip" directory: "/" schedule: interval: "daily" + open-pull-requests-limit: 3 From 24aa9cd41bf89ff41f4f6a759de24b0da82698f9 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 11 Sep 2026 13:08:00 +0100 Subject: [PATCH 2/2] Fix TokenPermissionsID: change top-level permissions to read, add job-level write Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions from 'contents: write, pull-requests: write' to read-only - Add job-level permissions to auto-merge-prs and dispatch-to-hypatia jobs This resolves Scorecard TokenPermissionsID alerts by following GitHub's recommended security practice of granting minimal top-level permissions and escalating only at the job level where needed. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/inbox-steward.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/inbox-steward.yml b/.github/workflows/inbox-steward.yml index 7169dff8..dd495ecd 100644 --- a/.github/workflows/inbox-steward.yml +++ b/.github/workflows/inbox-steward.yml @@ -47,8 +47,8 @@ on: # MONITORING; the auto-merge job itself is gated OFF by default (see below). permissions: - contents: write - pull-requests: write + contents: read + pull-requests: read repository-projects: read actions: read @@ -282,6 +282,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 needs: validate-prs + permissions: + contents: write + pull-requests: write # NEUTERED 2026-06-16 (owner directive: security/dep PRs are manual-review only). # Auto-merge is gated behind an explicit, default-OFF opt-in. Until the repo # variable INBOX_STEWARD_AUTOMERGE is set to 'true', this job NEVER runs and @@ -376,7 +379,8 @@ jobs: timeout-minutes: 5 needs: [identify-passed-prs, validate-prs, auto-merge-prs] if: always() && (needs.identify-passed-prs.result == 'success' || needs.validate-prs.result == 'success') - + permissions: + contents: write steps: - name: Checkout gitbot-fleet uses: actions/checkout@v7.0.1