Skip to content

Commit 2637e09

Browse files
SecAI-HubSecAI-Hub
committed
Add security scanning and hardening controls
1 parent 8bf0390 commit 2637e09

58 files changed

Lines changed: 1455 additions & 285 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitattributes‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,32 @@
1+
* text=auto eol=lf
2+
13
*.sh text eol=lf
4+
*.bash text eol=lf
5+
*.py text eol=lf
6+
Makefile text eol=lf
7+
*.md text eol=lf
8+
*.txt text eol=lf
9+
*.lock text eol=lf
10+
*.json text eol=lf
11+
*.yaml text eol=lf
12+
*.yml text eol=lf
13+
*.toml text eol=lf
14+
*.yar text eol=lf
15+
*.cff text eol=lf
16+
*.conf text eol=lf
17+
*.nft text eol=lf
18+
*.desktop text eol=lf
219
*.service text eol=lf
320
*.timer text eol=lf
421
*.socket text eol=lf
522
*.target text eol=lf
623
*.path text eol=lf
724
*.mount text eol=lf
25+
*.ps1 text eol=crlf
26+
Containerfile text eol=lf
27+
Containerfile.* text eol=lf
28+
Dockerfile text eol=lf
29+
Dockerfile.* text eol=lf
830
files/system/usr/lib/systemd/system/* text eol=lf
931
files/system/usr/libexec/secure-ai/* text eol=lf
1032
files/system/etc/greenboot/check/required.d/* text eol=lf

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Bug report
2+
description: Report a reproducible SecAI OS defect
3+
title: "[Bug]: "
4+
labels: ["bug"]
5+
body:
6+
- type: textarea
7+
id: summary
8+
attributes:
9+
label: Summary
10+
description: What failed, and what did you expect instead?
11+
validations:
12+
required: true
13+
- type: textarea
14+
id: steps
15+
attributes:
16+
label: Reproduction Steps
17+
description: Include exact commands, UI actions, or service requests.
18+
placeholder: |
19+
1. ...
20+
2. ...
21+
3. ...
22+
validations:
23+
required: true
24+
- type: textarea
25+
id: environment
26+
attributes:
27+
label: Environment
28+
description: Hardware, install path, image digest, release tag, and relevant service versions.
29+
validations:
30+
required: true
31+
- type: textarea
32+
id: logs
33+
attributes:
34+
label: Logs or Evidence
35+
description: Paste relevant logs, health output, or screenshots. Redact secrets.
36+
render: shell

‎.github/ISSUE_TEMPLATE/security_hardening.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Security hardening
2+
description: Propose a control, invariant, or assurance improvement
3+
title: "[Hardening]: "
4+
labels: ["security", "hardening"]
5+
body:
6+
- type: textarea
7+
id: control
8+
attributes:
9+
label: Control or Invariant
10+
description: What security property should be added, tightened, or verified?
11+
validations:
12+
required: true
13+
- type: textarea
14+
id: threat
15+
attributes:
16+
label: Threat Scenario
17+
description: What attack, misconfiguration, or regression does this address?
18+
validations:
19+
required: true
20+
- type: textarea
21+
id: implementation
22+
attributes:
23+
label: Suggested Implementation
24+
description: Mention affected services, docs, tests, and release checks if known.
25+
- type: dropdown
26+
id: assurance
27+
attributes:
28+
label: Assurance Impact
29+
options:
30+
- Blocks release readiness
31+
- Improves production hardening
32+
- Improves documentation or auditability
33+
- Product enhancement
34+
validations:
35+
required: true

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
## Summary
2+
3+
-
4+
5+
## Verification
6+
7+
- [ ] Go tests updated or not needed
8+
- [ ] Python tests updated or not needed
9+
- [ ] Docs updated or not needed
10+
- [ ] Security/release impact reviewed
11+
12+
## Security Notes
13+
14+
Describe any changes to policy, signing, sandboxing, network access, model
15+
promotion, key handling, or release artifacts.

‎.github/branch-protection.md‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Required branch protection settings for SecAI OS release infrastructure.
44
Configure these in GitHub Settings > Branches > Add branch protection rule,
55
or use the setup script below.
66

7-
Last updated: 2026-03-14
7+
Last updated: 2026-04-28
88

99
---
1010

@@ -24,18 +24,19 @@ Last updated: 2026-03-14
2424

2525
### Required status checks for `release/*`
2626

27-
All 7 of these must pass before a PR can merge into a release branch:
27+
All 8 of these must pass before a PR can merge into a release branch:
2828

29-
1. **Go Build & Test** (`go-build-and-test`) — Builds and tests all 9 Go services with race detector
30-
2. **Python Test & Lint** (`python-test`) — Ruff, bandit, mypy, unit/integration tests, adversarial + M5 acceptance
31-
3. **Security Regression Tests** (`security-regression`) — Adversarial tests (Python + Go MCP/policy/incident-recorder)
32-
4. **Dependency Vulnerability Audit** (`dependency-audit`) — govulncheck + pip-audit with waiver mechanism
33-
5. **Test Count Drift Check** (`test-count-check`) — Ensures test counts don't drop below documented floor
34-
6. **Documentation Validation** (`docs-validation`) — Broken links, required docs, milestone count consistency, test references
35-
7. **Release Branch Hardened Gate** (`release-gate`) — Zero-tolerance bandit, CVE-ID govulncheck waivers, M5 acceptance re-run
29+
1. **Go Build & Test** (`go-build-and-test`) -- Builds and tests all 9 Go services with race detector
30+
2. **Python Test & Lint** (`python-test`) -- Ruff, bandit, mypy, unit/integration tests, adversarial + M5 acceptance
31+
3. **Security Regression Tests** (`security-regression`) -- Adversarial tests (Python + Go MCP/policy/incident-recorder)
32+
4. **Hadolint & Semgrep** (`appsec-lint`) -- Container linting plus repo-owned application security rules
33+
5. **Dependency Vulnerability Audit** (`dependency-audit`) -- govulncheck + pip-audit with waiver mechanism
34+
6. **Test Count Drift Check** (`test-count-check`) -- Ensures test counts do not drop below documented floor
35+
7. **Documentation Validation** (`docs-validation`) -- Broken links, required docs, milestone count consistency, test references
36+
8. **Release Branch Hardened Gate** (`release-gate`) -- Zero-tolerance bandit, CVE-ID govulncheck waivers, M5 acceptance re-run
3637

3738
The `release-gate` job has `needs:` on all of the above, so configuring it as the sole required check is sufficient.
38-
However, listing all 7 makes failure diagnosis easier in the GitHub UI.
39+
However, listing all 8 makes failure diagnosis easier in the GitHub UI.
3940

4041
---
4142

@@ -71,7 +72,7 @@ patterns (`release/*`) requires using rulesets. The script below uses the
7172
branch protection API for `stable` (exact name) and documents the UI steps
7273
for wildcard patterns.
7374

74-
### For `stable` branch (exact match — API supported)
75+
### For `stable` branch (exact match -- API supported)
7576

7677
```bash
7778
#!/usr/bin/env bash
@@ -90,6 +91,7 @@ gh api -X PUT "repos/${OWNER}/${REPO}/branches/stable/protection" \
9091
{"context": "Go Build & Test"},
9192
{"context": "Python Test & Lint"},
9293
{"context": "Security Regression Tests"},
94+
{"context": "Hadolint & Semgrep"},
9395
{"context": "Dependency Vulnerability Audit"},
9496
{"context": "Test Count Drift Check"},
9597
{"context": "Documentation Validation"},
@@ -109,10 +111,10 @@ EOF
109111
echo "OK: Branch protection set for stable"
110112
```
111113

112-
### For `release/*` branches (wildcard — use GitHub UI)
114+
### For `release/*` branches (wildcard -- use GitHub UI)
113115

114116
1. Go to **Settings > Branches > Add branch protection rule**
115117
2. Branch name pattern: `release/*`
116118
3. Enable all settings listed in the table above
117-
4. Under "Require status checks to pass", add all 7 check names listed above
119+
4. Under "Require status checks to pass", add all 8 check names listed above
118120
5. Save changes

‎.github/container-pin-waivers.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"_comment": "Temporary waivers for FROM refs that cannot be represented as a single static digest because the build arg selects multiple upstream variants. Each waiver must expire and must be reviewed before renewal.",
3+
"dynamic_from": [
4+
{
5+
"path": "services/inference-worker/Containerfile",
6+
"image_ref": "ghcr.io/ggml-org/llama.cpp:${IMAGE_TAG}",
7+
"reason": "IMAGE_TAG selects CPU/CUDA/ROCm/Vulkan/Intel llama.cpp variants. Production builds must pass the resolved digest through release metadata until this is split into per-variant pinned stages.",
8+
"reviewer": "sec_ai",
9+
"expires": "2026-06-30"
10+
}
11+
]
12+
}

‎.github/dependabot.yml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,149 @@ updates:
44
directory: "/"
55
schedule:
66
interval: "daily"
7+
groups:
8+
github-actions:
9+
patterns: ["*"]
10+
11+
- package-ecosystem: "pip"
12+
directory: "/"
13+
schedule:
14+
interval: "weekly"
15+
groups:
16+
python-ci:
17+
patterns: ["*"]
18+
19+
- package-ecosystem: "pip"
20+
directory: "/services/agent"
21+
schedule:
22+
interval: "weekly"
23+
24+
- package-ecosystem: "pip"
25+
directory: "/services/quarantine"
26+
schedule:
27+
interval: "weekly"
28+
29+
- package-ecosystem: "pip"
30+
directory: "/services/search-mediator"
31+
schedule:
32+
interval: "weekly"
33+
34+
- package-ecosystem: "pip"
35+
directory: "/services/ui"
36+
schedule:
37+
interval: "weekly"
38+
39+
- package-ecosystem: "gomod"
40+
directory: "/services/airlock"
41+
schedule:
42+
interval: "weekly"
43+
44+
- package-ecosystem: "gomod"
45+
directory: "/services/gpu-integrity-watch"
46+
schedule:
47+
interval: "weekly"
48+
49+
- package-ecosystem: "gomod"
50+
directory: "/services/incident-recorder"
51+
schedule:
52+
interval: "weekly"
53+
54+
- package-ecosystem: "gomod"
55+
directory: "/services/integrity-monitor"
56+
schedule:
57+
interval: "weekly"
58+
59+
- package-ecosystem: "gomod"
60+
directory: "/services/mcp-firewall"
61+
schedule:
62+
interval: "weekly"
63+
64+
- package-ecosystem: "gomod"
65+
directory: "/services/policy-engine"
66+
schedule:
67+
interval: "weekly"
68+
69+
- package-ecosystem: "gomod"
70+
directory: "/services/registry"
71+
schedule:
72+
interval: "weekly"
73+
74+
- package-ecosystem: "gomod"
75+
directory: "/services/runtime-attestor"
76+
schedule:
77+
interval: "weekly"
78+
79+
- package-ecosystem: "gomod"
80+
directory: "/services/tool-firewall"
81+
schedule:
82+
interval: "weekly"
83+
84+
- package-ecosystem: "docker"
85+
directory: "/services/agent"
86+
schedule:
87+
interval: "weekly"
88+
89+
- package-ecosystem: "docker"
90+
directory: "/services/airlock"
91+
schedule:
92+
interval: "weekly"
93+
94+
- package-ecosystem: "docker"
95+
directory: "/services/diffusion-worker"
96+
schedule:
97+
interval: "weekly"
98+
99+
- package-ecosystem: "docker"
100+
directory: "/services/gpu-integrity-watch"
101+
schedule:
102+
interval: "weekly"
103+
104+
- package-ecosystem: "docker"
105+
directory: "/services/inference-worker"
106+
schedule:
107+
interval: "weekly"
108+
109+
- package-ecosystem: "docker"
110+
directory: "/services/mcp-firewall"
111+
schedule:
112+
interval: "weekly"
113+
114+
- package-ecosystem: "docker"
115+
directory: "/services/policy-engine"
116+
schedule:
117+
interval: "weekly"
118+
119+
- package-ecosystem: "docker"
120+
directory: "/services/quarantine"
121+
schedule:
122+
interval: "weekly"
123+
124+
- package-ecosystem: "docker"
125+
directory: "/services/registry"
126+
schedule:
127+
interval: "weekly"
128+
129+
- package-ecosystem: "docker"
130+
directory: "/services/search-mediator"
131+
schedule:
132+
interval: "weekly"
133+
134+
- package-ecosystem: "docker"
135+
directory: "/services/tool-firewall"
136+
schedule:
137+
interval: "weekly"
138+
139+
- package-ecosystem: "docker"
140+
directory: "/services/ui"
141+
schedule:
142+
interval: "weekly"
143+
144+
- package-ecosystem: "docker"
145+
directory: "/deploy/sandbox/searxng"
146+
schedule:
147+
interval: "weekly"
148+
149+
- package-ecosystem: "docker"
150+
directory: "/deploy/sandbox/tor"
151+
schedule:
152+
interval: "weekly"

0 commit comments

Comments
 (0)