From aa5cce1e6c279364fba5a63d94d48835214dec3d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 11 Sep 2026 10:01:30 +0100 Subject: [PATCH 1/5] fix(ci): remove rust-ci.yml as repo has no Cargo.toml Removing rust-ci.yml workflow since this repository has no Rust code (Cargo.toml not present). The reusable rust-ci-reusable.yml already guards itself by detecting Cargo.toml presence, but repos without Rust code shouldn't trigger unnecessary workflow runs. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/rust-ci.yml | 20 -------------------- 1 file changed, 20 deletions(-) delete mode 100644 .github/workflows/rust-ci.yml diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml deleted file mode 100644 index acf3bf45e..000000000 --- a/.github/workflows/rust-ci.yml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. -name: Rust CI - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - ci: - uses: ./.github/workflows/rust-ci-reusable.yml From aeb2fe1c274be79898e4a0ce1345cd2d260c48ad Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 11 Sep 2026 10:36:37 +0100 Subject: [PATCH 2/5] fix(ci): add persist-credentials: false to checkout actions in reusable workflows - Add persist-credentials: false to checkout action in codeql-reusable.yml - Add persist-credentials: false to checkout action in hypatia-scan-reusable.yml This prevents credential persistence in CI/CD workflows, improving security. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/codeql-reusable.yml | 2 ++ .github/workflows/hypatia-scan-reusable.yml | 1 + 2 files changed, 3 insertions(+) diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml index 0e117acc3..9ec8d43af 100644 --- a/.github/workflows/codeql-reusable.yml +++ b/.github/workflows/codeql-reusable.yml @@ -89,6 +89,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Initialize CodeQL uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3 diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml index 913d0fc2d..cc58c0cb2 100644 --- a/.github/workflows/hypatia-scan-reusable.yml +++ b/.github/workflows/hypatia-scan-reusable.yml @@ -27,6 +27,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - name: Setup Elixir for Hypatia scanner uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 From 49bf1a22fd3a906c6dde59819a404095b64834dc Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 11 Sep 2026 13:07:55 +0100 Subject: [PATCH 3/5] Fix TokenPermissionsID: change top-level permissions to read, add job-level write Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions from 'contents: write' to 'contents: read' - Add job-level 'permissions: contents: write' to jobs that need it This resolves Scorecard TokenPermissionsID alerts by following GitHub's recommended security practice of granting minimal top-level permissions and escalating only at the job level where needed. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/signed-push-smoke.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/signed-push-smoke.yml b/.github/workflows/signed-push-smoke.yml index 9e13cbfc9..675ae0655 100644 --- a/.github/workflows/signed-push-smoke.yml +++ b/.github/workflows/signed-push-smoke.yml @@ -14,7 +14,7 @@ concurrency: group: ${{ github.workflow }} permissions: - contents: write + contents: read jobs: smoke: @@ -23,6 +23,8 @@ jobs: # job that `uses:` a reusable workflow — it is an illegal key there and # GitHub refuses to parse the ENTIRE file, killing every job in it. timeout-minutes: 10 + permissions: + contents: write steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 From e12248c0e1996e5c2f1c618fbb47da4f6cb3ff43 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 11 Sep 2026 14:15:47 +0100 Subject: [PATCH 4/5] Fix TokenPermissionsID: apply least-privilege permissions Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions to read-only - Jobs inherit read permissions, can escalate as needed This resolves Scorecard TokenPermissionsID alerts. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/changelog.yml | 2 +- .github/workflows/readme-derive.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 839fd4b57..53dfed2f2 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -14,7 +14,7 @@ permissions: # leaving this out makes GitHub reject the run at startup_failure with zero # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'". actions: read - contents: write + contents: read pull-requests: write jobs: diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml index ef8408de3..ba51d78ed 100644 --- a/.github/workflows/readme-derive.yml +++ b/.github/workflows/readme-derive.yml @@ -24,7 +24,7 @@ permissions: # leaving this out makes GitHub reject the run at startup_failure with zero # jobs and no log — "requesting 'actions: read', but is only allowed 'actions: none'". actions: read - contents: write + contents: read jobs: derive: From e22f91d9229bee5cac23b11a212315ad07088927 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 11 Sep 2026 17:29:32 +0100 Subject: [PATCH 5/5] feat: add modern GitHub rulesets for maximum compliance - Add Optimus-Branch.json for branch protection - Add Immutable-Tags.json for tag protection - Both use native GitHub rulesets API (no bypass actors) - Replaces deprecated probot/settings branch protection Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- config/rulesets/Immutable-Tags.json | 19 +++++++++++++ config/rulesets/Optimus-Branch.json | 44 +++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+) create mode 100644 config/rulesets/Immutable-Tags.json create mode 100644 config/rulesets/Optimus-Branch.json diff --git a/config/rulesets/Immutable-Tags.json b/config/rulesets/Immutable-Tags.json new file mode 100644 index 000000000..53739afe3 --- /dev/null +++ b/config/rulesets/Immutable-Tags.json @@ -0,0 +1,19 @@ +{ + "name": "Immutable-Tags", + "target": "tag", + "enforcement": "active", + "conditions": { + "ref_name": { + "include": ["~ALL"], + "exclude": [] + } + }, + "bypass_actors": [], + "rules": [ + {"type": "creation"}, + {"type": "deletion"}, + {"type": "non_fast_forward"}, + {"type": "update"}, + {"type": "required_signatures"} + ] +} diff --git a/config/rulesets/Optimus-Branch.json b/config/rulesets/Optimus-Branch.json new file mode 100644 index 000000000..03ad48821 --- /dev/null +++ b/config/rulesets/Optimus-Branch.json @@ -0,0 +1,44 @@ +{ + "name": "Optimus-Branch", + "target": "branch", + "enforcement": "active", + "conditions": { + "ref_name": { + "include": ["~DEFAULT_BRANCH"], + "exclude": [] + } + }, + "bypass_actors": [], + "rules": [ + { + "type": "deletion" + }, + { + "type": "non_fast_forward" + }, + { + "type": "required_signatures" + }, + { + "type": "pull_request", + "parameters": { + "required_approving_review_count": 2, + "dismiss_stale_reviews_on_push": true, + "require_code_owner_review": true, + "require_last_push_approval": true, + "required_review_thread_resolution": true, + "require_extra_approval_for_unattributed_changes": true, + "required_reviewers": [], + "allowed_merge_methods": [] + } + }, + { + "type": "required_status_checks", + "parameters": { + "strict_required_status_checks_policy": true, + "do_not_enforce_on_create": false, + "required_status_checks": [] + } + } + ] +}