From 8b6eae7b9b9cb300cea066eea0e13a9d3aa8c9eb Mon Sep 17 00:00:00 2001 From: Julian Risch Date: Thu, 25 Jun 2026 16:36:06 +0200 Subject: [PATCH 1/5] ci: pin container, go and npm dependencies (OpenSSF Scorecard) Improves the OpenSSF Scorecard Pinned-Dependencies check: - docker/Dockerfile.base: give build_image/base_image pinned digest defaults and reference them as ${...} so scorecard resolves the FROM images by hash (containerImage 1/3 -> 3/3). docker-bake.hcl still overrides them at build time. - workflows_linting.yml: pin actionlint to v1.7.12 instead of @latest (goCommand 0/1 -> 1/1; scorecard treats full semver as pinned). - docs_search_sync.yml: use `npm ci` instead of `npm install` so the install verifies the committed lockfile (npmCommand 0/1 -> 1/1). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/docs_search_sync.yml | 2 +- .github/workflows/workflows_linting.yml | 2 +- docker/Dockerfile.base | 11 +++++++---- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/docs_search_sync.yml b/.github/workflows/docs_search_sync.yml index d34f32c750a..67511f34d0c 100644 --- a/.github/workflows/docs_search_sync.yml +++ b/.github/workflows/docs_search_sync.yml @@ -36,7 +36,7 @@ jobs: - name: Install Docusaurus and build docs-website working-directory: docs-website run: | - npm install --ignore-scripts + npm ci --ignore-scripts npm rebuild sharp npm run build diff --git a/.github/workflows/workflows_linting.yml b/.github/workflows/workflows_linting.yml index 9801257050f..16bb61e0eca 100644 --- a/.github/workflows/workflows_linting.yml +++ b/.github/workflows/workflows_linting.yml @@ -22,7 +22,7 @@ jobs: go-version: ">=1.24.0" - name: Install actionlint - run: go install github.com/rhysd/actionlint/cmd/actionlint@latest + run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 - name: Run actionlint env: diff --git a/docker/Dockerfile.base b/docker/Dockerfile.base index e3de37c8a8f..c4cee03a765 100644 --- a/docker/Dockerfile.base +++ b/docker/Dockerfile.base @@ -1,7 +1,10 @@ -ARG build_image -ARG base_image +# Pinned digest defaults so the base images are resolvable by hash even when +# the args are not passed (e.g. by supply-chain scanners or a plain `docker build`). +# docker/docker-bake.hcl overrides these at build time; keep the digests in sync. +ARG build_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203 +ARG base_image=python:3.12-slim@sha256:090ba77e2958f6af52a5341f788b50b032dd4ca28377d2893dcf1ecbdfdfe203 -FROM $build_image AS build-image +FROM ${build_image} AS build-image ARG DEBIAN_FRONTEND=noninteractive ARG haystack_version @@ -25,7 +28,7 @@ ENV PATH="/opt/venv/bin:$PATH" RUN uv pip install --no-cache-dir -U setuptools && \ uv pip install --no-cache-dir . -FROM $base_image AS final +FROM ${base_image} AS final COPY --from=build-image /opt/venv /opt/venv From db4f35783a454fa1bb1aab69a933d59de98b2bb5 Mon Sep 17 00:00:00 2001 From: Julian Risch Date: Thu, 25 Jun 2026 16:36:09 +0200 Subject: [PATCH 2/5] ci: add CodeQL advanced setup for SAST coverage Adds a committed CodeQL workflow (advanced setup) that runs on push and pull_request to main plus a weekly schedule, so the OpenSSF Scorecard SAST check reliably credits CodeQL via both its workflow-config and runs-on-commits probes. GitHub's "default setup" has no workflow file and is not consistently detected (see ossf/scorecard#3817). Action versions are SHA-pinned and kept fresh by Dependabot. Note: CodeQL default setup must be disabled in repo settings before merging, since GitHub does not allow default and advanced setup together. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/codeql.yml | 71 ++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000000..ea493795198 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,71 @@ +# CodeQL (SAST) +# +# Advanced setup for GitHub code scanning, committed as a workflow file so it is +# reliably credited by the OpenSSF Scorecard SAST check: +# - scorecard's CodeQL-config probe only fires when a workflow references +# `github/codeql-action/analyze` (GitHub's "default setup" has no such file), +# - running `on: pull_request` produces a CodeQL check on every PR's commits, +# which scorecard's "runs on all commits" probe looks for. +# See https://github.com/ossf/scorecard/issues/3817 for why default setup is not +# enough on its own. +# +# IMPORTANT: GitHub does not allow advanced setup and "default setup" at the same +# time. Disable CodeQL default setup under +# Settings -> Code security -> Code scanning -> CodeQL analysis -> Default setup +# before merging this workflow, otherwise the analyze step fails. +# +# Action versions are pinned by commit SHA (required by the pinned-dependencies +# check) and kept fresh by Dependabot's `github-actions` updater. + +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + # Weekly baseline scan of the default branch. + - cron: "27 4 * * 1" + workflow_dispatch: + +permissions: + contents: read + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + permissions: + # Required to upload code-scanning results to the Security tab. + security-events: write + # Required by codeql-action to read the workflow/CI config. + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + include: + # Haystack is a Python project; Python is interpreted, so no build is + # needed. Add `javascript-typescript` here if the docs-website JS code + # should also be scanned. + - language: python + build-mode: none + + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Initialize CodeQL + uses: github/codeql-action/init@9887d98ae49f1f598651b556d8c8f02f3ea065cb # v3.27.0 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@9887d98ae49f1f598651b556d8c8f02f3ea065cb # v3.27.0 + with: + category: "/language:${{ matrix.language }}" From 62d8de45f29d04a3fd83d67d440269a2f1df80d4 Mon Sep 17 00:00:00 2001 From: Julian Risch Date: Thu, 25 Jun 2026 16:49:23 +0200 Subject: [PATCH 3/5] Removed comments and schedule for CodeQL workflow. --- .github/workflows/codeql.yml | 22 ---------------------- 1 file changed, 22 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ea493795198..aeb0856345e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,22 +1,3 @@ -# CodeQL (SAST) -# -# Advanced setup for GitHub code scanning, committed as a workflow file so it is -# reliably credited by the OpenSSF Scorecard SAST check: -# - scorecard's CodeQL-config probe only fires when a workflow references -# `github/codeql-action/analyze` (GitHub's "default setup" has no such file), -# - running `on: pull_request` produces a CodeQL check on every PR's commits, -# which scorecard's "runs on all commits" probe looks for. -# See https://github.com/ossf/scorecard/issues/3817 for why default setup is not -# enough on its own. -# -# IMPORTANT: GitHub does not allow advanced setup and "default setup" at the same -# time. Disable CodeQL default setup under -# Settings -> Code security -> Code scanning -> CodeQL analysis -> Default setup -# before merging this workflow, otherwise the analyze step fails. -# -# Action versions are pinned by commit SHA (required by the pinned-dependencies -# check) and kept fresh by Dependabot's `github-actions` updater. - name: CodeQL on: @@ -24,9 +5,6 @@ on: branches: [main] pull_request: branches: [main] - schedule: - # Weekly baseline scan of the default branch. - - cron: "27 4 * * 1" workflow_dispatch: permissions: From af8e2984c9b54586751242913c72ca84644e5973 Mon Sep 17 00:00:00 2001 From: Julian Risch Date: Thu, 25 Jun 2026 17:26:41 +0200 Subject: [PATCH 4/5] ci: harden CodeQL workflow and clarify Docker digest maintenance Addresses review feedback: - codeql.yml: add a concurrency group (cancel superseded runs) and timeout-minutes: 360 as a guard against a hung analysis. - codeql.yml: bump github/codeql-action from v3.27.0 to v3.36.2 (still SHA-pinned; kept fresh by Dependabot's github-actions updater). - dependabot.yml: correct the docker comment -- Dependabot does not parse images that reach FROM via an ARG, so the build_image/base_image ARG defaults in Dockerfile.base are not auto-tracked and must be bumped by hand and kept in sync with docker/docker-bake.hcl. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 9 ++++++--- .github/workflows/codeql.yml | 11 +++++++++-- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2d6a7bff63e..0e437ab0320 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,9 +22,12 @@ updates: default-days: 1 # Tracks the digest-pinned `COPY --from` image (ghcr.io/astral-sh/uv) in - # docker/Dockerfile.base. Note: the python:3.12-slim base/builder images are - # passed via build args from docker/docker-bake.hcl and the `docker run` image - # strings in workflows are not parsed by Dependabot; bump those manually. + # docker/Dockerfile.base. Note: the python:3.12-slim base/builder digests are + # carried both as the build_image/base_image ARG defaults in Dockerfile.base + # and in docker/docker-bake.hcl (which overrides them at build time). + # Dependabot does NOT parse images that reach FROM via an ARG, nor the + # `docker run` image strings in workflows, so bump those by hand and keep the + # Dockerfile.base ARG defaults and docker-bake.hcl digests in sync. - package-ecosystem: 'docker' directory: '/docker' schedule: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index aeb0856345e..fabd9edb146 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,10 +10,17 @@ on: permissions: contents: read +# Cancel a superseded run for the same ref (e.g. a force-push to a PR) so we +# don't burn CI minutes analyzing commits that are already stale. +concurrency: + group: codeql-${{ github.ref }} + cancel-in-progress: true + jobs: analyze: name: Analyze (${{ matrix.language }}) runs-on: ubuntu-latest + timeout-minutes: 360 permissions: # Required to upload code-scanning results to the Security tab. security-events: write @@ -38,12 +45,12 @@ jobs: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@9887d98ae49f1f598651b556d8c8f02f3ea065cb # v3.27.0 + uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@9887d98ae49f1f598651b556d8c8f02f3ea065cb # v3.27.0 + uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2 with: category: "/language:${{ matrix.language }}" From 0ce794825ef3994e084ee4cbeaa1697b4dbeafd1 Mon Sep 17 00:00:00 2001 From: Julian Risch Date: Thu, 25 Jun 2026 17:30:12 +0200 Subject: [PATCH 5/5] ci: align scorecard.yml codeql-action pin with codeql.yml (v3.36.2) Keeps github/codeql-action pinned to the same commit across both workflows so Dependabot bumps them together. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index fabed3d5173..a2ffa64daac 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -61,6 +61,6 @@ jobs: retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@9887d98ae49f1f598651b556d8c8f02f3ea065cb # v3.27.0 + uses: github/codeql-action/upload-sarif@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2 with: sarif_file: results.sarif