Skip to content

Commit dd30132

Browse files
DeusDataDeusData
committed
Pin Actions to SHA + enforce via security audit + Dependabot
- All GitHub Actions pinned to immutable commit SHAs (prevents tag-poisoning attacks like tj-actions/changed-files incident) - Security audit (Layer 1) now blocks unpinned Actions in CI - Dependabot configured to auto-propose SHA updates weekly - Pre-commit hooks tracked in scripts/hooks/ for contributors - Time-bomb detection + MCP file read audit added to Layer 1
1 parent c371e9f commit dd30132

File tree

5 files changed

+82
-48
lines changed

5 files changed

+82
-48
lines changed

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"

‎.github/workflows/dry-run.yml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
if: ${{ !inputs.skip_lint }}
2626
runs-on: ubuntu-latest
2727
steps:
28-
- uses: actions/checkout@v4
28+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2929

3030
- name: Install build deps
3131
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev cmake
@@ -37,7 +37,7 @@ jobs:
3737
sudo apt-get update
3838
sudo apt-get install -y clang-format-20
3939
40-
- uses: actions/cache@v4
40+
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
4141
id: cppcheck-cache
4242
with:
4343
path: /opt/cppcheck
@@ -64,7 +64,7 @@ jobs:
6464
if: ${{ !inputs.skip_lint }}
6565
runs-on: ubuntu-latest
6666
steps:
67-
- uses: actions/checkout@v4
67+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
6868

6969
- name: "Layer 1: Static allow-list audit"
7070
run: scripts/security-audit.sh
@@ -104,7 +104,7 @@ jobs:
104104
cxx: c++
105105
runs-on: ${{ matrix.os }}
106106
steps:
107-
- uses: actions/checkout@v4
107+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
108108

109109
- name: Install deps (Ubuntu)
110110
if: startsWith(matrix.os, 'ubuntu')
@@ -118,9 +118,9 @@ jobs:
118118
needs: [lint]
119119
runs-on: windows-latest
120120
steps:
121-
- uses: actions/checkout@v4
121+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
122122

123-
- uses: msys2/setup-msys2@v2
123+
- uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2
124124
with:
125125
msystem: CLANG64
126126
path-type: inherit
@@ -163,13 +163,13 @@ jobs:
163163
cxx: c++
164164
runs-on: ${{ matrix.os }}
165165
steps:
166-
- uses: actions/checkout@v4
166+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
167167

168168
- name: Install deps (Ubuntu)
169169
if: startsWith(matrix.os, 'ubuntu')
170170
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
171171

172-
- uses: actions/setup-node@v4
172+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
173173
with:
174174
node-version: "22"
175175

@@ -193,7 +193,7 @@ jobs:
193193
tar -czf codebase-memory-mcp-ui-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz \
194194
-C build/c codebase-memory-mcp
195195
196-
- uses: actions/upload-artifact@v4
196+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
197197
with:
198198
name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
199199
path: "*.tar.gz"
@@ -203,9 +203,9 @@ jobs:
203203
needs: [test-unix, test-windows]
204204
runs-on: windows-latest
205205
steps:
206-
- uses: actions/checkout@v4
206+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
207207

208-
- uses: msys2/setup-msys2@v2
208+
- uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2
209209
with:
210210
msystem: CLANG64
211211
path-type: inherit
@@ -215,7 +215,7 @@ jobs:
215215
make
216216
zip
217217
218-
- uses: actions/setup-node@v4
218+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
219219
with:
220220
node-version: "22"
221221

@@ -243,7 +243,7 @@ jobs:
243243
cp "$BIN" codebase-memory-mcp-ui.exe
244244
zip codebase-memory-mcp-ui-windows-amd64.zip codebase-memory-mcp-ui.exe
245245
246-
- uses: actions/upload-artifact@v4
246+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
247247
with:
248248
name: binaries-windows-amd64
249249
path: "*.zip"
@@ -271,9 +271,9 @@ jobs:
271271
variant: [standard, ui]
272272
runs-on: ${{ matrix.os }}
273273
steps:
274-
- uses: actions/checkout@v4
274+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
275275

276-
- uses: actions/download-artifact@v4
276+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
277277
with:
278278
name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
279279

@@ -338,17 +338,17 @@ jobs:
338338
variant: [standard, ui]
339339
runs-on: windows-latest
340340
steps:
341-
- uses: actions/checkout@v4
341+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
342342

343-
- uses: msys2/setup-msys2@v2
343+
- uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2
344344
with:
345345
msystem: CLANG64
346346
path-type: inherit
347347
install: >-
348348
mingw-w64-clang-x86_64-python3
349349
unzip
350350
351-
- uses: actions/download-artifact@v4
351+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
352352
with:
353353
name: binaries-windows-amd64
354354

‎.github/workflows/release.yml‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
lint:
2828
runs-on: ubuntu-latest
2929
steps:
30-
- uses: actions/checkout@v4
30+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3131

3232
- name: Install build deps
3333
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev cmake
@@ -39,7 +39,7 @@ jobs:
3939
sudo apt-get update
4040
sudo apt-get install -y clang-format-20
4141
42-
- uses: actions/cache@v4
42+
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
4343
id: cppcheck-cache
4444
with:
4545
path: /opt/cppcheck
@@ -65,7 +65,7 @@ jobs:
6565
security-static:
6666
runs-on: ubuntu-latest
6767
steps:
68-
- uses: actions/checkout@v4
68+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
6969

7070
- name: "Layer 1: Static allow-list audit"
7171
run: scripts/security-audit.sh
@@ -104,7 +104,7 @@ jobs:
104104
cxx: c++
105105
runs-on: ${{ matrix.os }}
106106
steps:
107-
- uses: actions/checkout@v4
107+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
108108

109109
- name: Install deps (Ubuntu)
110110
if: startsWith(matrix.os, 'ubuntu')
@@ -117,9 +117,9 @@ jobs:
117117
needs: [lint]
118118
runs-on: windows-latest
119119
steps:
120-
- uses: actions/checkout@v4
120+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
121121

122-
- uses: msys2/setup-msys2@v2
122+
- uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2
123123
with:
124124
msystem: CLANG64
125125
path-type: inherit
@@ -161,13 +161,13 @@ jobs:
161161
cxx: c++
162162
runs-on: ${{ matrix.os }}
163163
steps:
164-
- uses: actions/checkout@v4
164+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
165165

166166
- name: Install deps (Ubuntu)
167167
if: startsWith(matrix.os, 'ubuntu')
168168
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
169169

170-
- uses: actions/setup-node@v4
170+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
171171
with:
172172
node-version: "22"
173173

@@ -191,7 +191,7 @@ jobs:
191191
tar -czf codebase-memory-mcp-ui-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz \
192192
-C build/c codebase-memory-mcp
193193
194-
- uses: actions/upload-artifact@v4
194+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
195195
with:
196196
name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
197197
path: "*.tar.gz"
@@ -200,9 +200,9 @@ jobs:
200200
needs: [test-unix, test-windows]
201201
runs-on: windows-latest
202202
steps:
203-
- uses: actions/checkout@v4
203+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
204204

205-
- uses: msys2/setup-msys2@v2
205+
- uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2
206206
with:
207207
msystem: CLANG64
208208
path-type: inherit
@@ -212,7 +212,7 @@ jobs:
212212
make
213213
zip
214214
215-
- uses: actions/setup-node@v4
215+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
216216
with:
217217
node-version: "22"
218218

@@ -240,7 +240,7 @@ jobs:
240240
cp "$BIN" codebase-memory-mcp-ui.exe
241241
zip codebase-memory-mcp-ui-windows-amd64.zip codebase-memory-mcp-ui.exe
242242
243-
- uses: actions/upload-artifact@v4
243+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
244244
with:
245245
name: binaries-windows-amd64
246246
path: "*.zip"
@@ -266,9 +266,9 @@ jobs:
266266
variant: [standard, ui]
267267
runs-on: ${{ matrix.os }}
268268
steps:
269-
- uses: actions/checkout@v4
269+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
270270

271-
- uses: actions/download-artifact@v4
271+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
272272
with:
273273
name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
274274

@@ -334,17 +334,17 @@ jobs:
334334
variant: [standard, ui]
335335
runs-on: windows-latest
336336
steps:
337-
- uses: actions/checkout@v4
337+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
338338

339-
- uses: msys2/setup-msys2@v2
339+
- uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2
340340
with:
341341
msystem: CLANG64
342342
path-type: inherit
343343
install: >-
344344
mingw-w64-clang-x86_64-python3
345345
unzip
346346
347-
- uses: actions/download-artifact@v4
347+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
348348
with:
349349
name: binaries-windows-amd64
350350

@@ -396,9 +396,9 @@ jobs:
396396
id-token: write
397397
attestations: write
398398
steps:
399-
- uses: actions/checkout@v4
399+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
400400

401-
- uses: actions/download-artifact@v4
401+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
402402
with:
403403
merge-multiple: true
404404

@@ -410,17 +410,17 @@ jobs:
410410

411411
# ── Artifact attestations (SLSA provenance) ──────────────
412412
- name: Attest build provenance (tar.gz)
413-
uses: actions/attest-build-provenance@v2
413+
uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2
414414
with:
415415
subject-path: '*.tar.gz'
416416

417417
- name: Attest build provenance (zip)
418-
uses: actions/attest-build-provenance@v2
418+
uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2
419419
with:
420420
subject-path: '*.zip'
421421

422422
- name: Attest build provenance (checksums)
423-
uses: actions/attest-build-provenance@v2
423+
uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2
424424
with:
425425
subject-path: 'checksums.txt'
426426

@@ -434,14 +434,14 @@ jobs:
434434
python3 -c "import json; d=json.load(open('sbom.json')); json.dump(d,open('sbom.json','w'),indent=2)"
435435
436436
- name: Attest SBOM
437-
uses: actions/attest-sbom@v2
437+
uses: actions/attest-sbom@10926c72720ffc3f7b666661c8e55b1344e2a365 # v2
438438
with:
439439
subject-path: '*.tar.gz'
440440
sbom-path: 'sbom.json'
441441

442442
# ── Sigstore cosign signing ──────────────────────────────
443443
- name: Install cosign
444-
uses: sigstore/cosign-installer@v3
444+
uses: sigstore/cosign-installer@f713795cb21599bc4e5c4b58cbad1da852d7eeb9 # v3
445445

446446
- name: Sign release artifacts with cosign
447447
run: |
@@ -464,7 +464,7 @@ jobs:
464464
git tag -f "$VERSION"
465465
git push origin "$VERSION" --force
466466
467-
- uses: softprops/action-gh-release@v2
467+
- uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
468468
with:
469469
tag_name: ${{ inputs.version }}
470470
draft: true
@@ -489,7 +489,7 @@ jobs:
489489
security-events: write
490490
id-token: write
491491
steps:
492-
- uses: actions/checkout@v4
492+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
493493
with:
494494
persist-credentials: false
495495

@@ -504,7 +504,7 @@ jobs:
504504
ls -la assets/
505505
506506
- name: Scan all binaries with VirusTotal
507-
uses: crazy-max/ghaction-virustotal@v4
507+
uses: crazy-max/ghaction-virustotal@d34968c958ae283fe976efed637081b9f9dcf74f # v4
508508
id: virustotal
509509
with:
510510
vt_api_key: ${{ secrets.VIRUS_TOTAL_SCANNER_API_KEY }}
@@ -607,15 +607,15 @@ jobs:
607607
608608
# ── OpenSSF Scorecard ────────────────────────────────────
609609
- name: Run OpenSSF Scorecard
610-
uses: ossf/scorecard-action@v2
610+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
611611
id: scorecard
612612
with:
613613
results_file: scorecard.sarif
614614
results_format: sarif
615615
publish_results: true
616616

617617
- name: Upload Scorecard SARIF
618-
uses: github/codeql-action/upload-sarif@v3
618+
uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4
619619
with:
620620
sarif_file: scorecard.sarif
621621

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,4 @@ graph-ui/dist/
5050
BENCHMARK_REPORT.md
5151
TEST_PLAN.md
5252
CHANGELOG.md
53+
.github/workflows/scorecard.yml

0 commit comments

Comments
 (0)