Skip to content

Commit aba257a

Browse files
claudeclaude
committed
ci: restore Hypatia-required workflows + harden (codeql actions, mirror secret-gates, setup.sh)
Pruning removed workflows the estate Hypatia policy REQUIRES (scorecard, mirror, secret-scanner) and the SAST workflow (codeql), which just traded the old findings for 'missing_workflow' errors. Restore those four and fix them properly instead: - codeql.yml: language matrix javascript-typescript -> actions (a brand surface has no JS/TS source; 'actions' scans the workflow files that exist) - mirror.yml: presence-gate every secret-using ssh-agent step (if: secrets.X != '') — clears secret_action_without_presence_gate - setup.sh: replace curl|sh pipe-to-shell with download-then-run (CWE-494) Compiler/build workflows that the policy does NOT require (rust-ci, e2e, boj-build, openssf-compliance, release, instant-sync, dogfood-gate, static-analysis-gate, rhodibot, scorecard-enforcer) stay pruned. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KPG9mEQXFyA3k7NWAzMNMr
1 parent 517483c commit aba257a

5 files changed

Lines changed: 337 additions & 3 deletions

File tree

‎.github/workflows/codeql.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
name: CodeQL Security Analysis
3+
4+
on:
5+
push:
6+
branches: [main, master]
7+
pull_request:
8+
branches: [main, master]
9+
schedule:
10+
- cron: '0 6 * * 1'
11+
12+
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
13+
# updates do not pile up queued runs against the shared account-wide
14+
# Actions concurrency pool. Applied only to read-only check workflows
15+
# (no publish/mutation), so cancelling a superseded run is always safe.
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: true
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
analyze:
25+
runs-on: ubuntu-latest
26+
timeout-minutes: 15
27+
permissions:
28+
contents: read
29+
security-events: write
30+
strategy:
31+
fail-fast: false
32+
matrix:
33+
include:
34+
- language: actions
35+
build-mode: none
36+
37+
steps:
38+
- name: Checkout
39+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
40+
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
43+
with:
44+
languages: ${{ matrix.language }}
45+
build-mode: ${{ matrix.build-mode }}
46+
47+
- name: Perform CodeQL Analysis
48+
uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3
49+
with:
50+
category: "/language:${{ matrix.language }}"

‎.github/workflows/mirror.yml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
3+
name: Mirror to Git Forges
4+
5+
on:
6+
push:
7+
branches: [main]
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
mirror-gitlab:
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 15
17+
if: vars.GITLAB_MIRROR_ENABLED == 'true'
18+
steps:
19+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20+
with:
21+
fetch-depth: 0
22+
23+
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
24+
if: ${{ secrets.GITLAB_SSH_KEY != '' }}
25+
with:
26+
ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
27+
28+
- name: Mirror to GitLab
29+
run: |
30+
ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
31+
git remote add gitlab git@gitlab.com:${{ vars.GITLAB_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
32+
git push --force gitlab main
33+
34+
mirror-bitbucket:
35+
runs-on: ubuntu-latest
36+
timeout-minutes: 15
37+
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
38+
steps:
39+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
40+
with:
41+
fetch-depth: 0
42+
43+
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
44+
if: ${{ secrets.BITBUCKET_SSH_KEY != '' }}
45+
with:
46+
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
47+
48+
- name: Mirror to Bitbucket
49+
run: |
50+
ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
51+
git remote add bitbucket git@bitbucket.org:${{ vars.BITBUCKET_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
52+
git push --force bitbucket main
53+
54+
mirror-codeberg:
55+
runs-on: ubuntu-latest
56+
timeout-minutes: 15
57+
if: vars.CODEBERG_MIRROR_ENABLED == 'true'
58+
steps:
59+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
60+
with:
61+
fetch-depth: 0
62+
63+
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
64+
if: ${{ secrets.CODEBERG_SSH_KEY != '' }}
65+
with:
66+
ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
67+
68+
- name: Mirror to Codeberg
69+
run: |
70+
ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts
71+
git remote add codeberg git@codeberg.org:${{ vars.CODEBERG_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
72+
git push --force codeberg main
73+
74+
mirror-sourcehut:
75+
runs-on: ubuntu-latest
76+
timeout-minutes: 15
77+
if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
78+
steps:
79+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
80+
with:
81+
fetch-depth: 0
82+
83+
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
84+
if: ${{ secrets.SOURCEHUT_SSH_KEY != '' }}
85+
with:
86+
ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
87+
88+
- name: Mirror to SourceHut
89+
run: |
90+
ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts
91+
git remote add sourcehut git@git.sr.ht:~${{ vars.SOURCEHUT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }} || true
92+
git push --force sourcehut main
93+
94+
mirror-disroot:
95+
runs-on: ubuntu-latest
96+
timeout-minutes: 15
97+
if: vars.DISROOT_MIRROR_ENABLED == 'true'
98+
steps:
99+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
100+
with:
101+
fetch-depth: 0
102+
103+
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
104+
if: ${{ secrets.DISROOT_SSH_KEY != '' }}
105+
with:
106+
ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
107+
108+
- name: Mirror to Disroot
109+
run: |
110+
ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts
111+
git remote add disroot git@git.disroot.org:${{ vars.DISROOT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
112+
git push --force disroot main
113+
114+
mirror-gitea:
115+
runs-on: ubuntu-latest
116+
timeout-minutes: 15
117+
if: vars.GITEA_MIRROR_ENABLED == 'true'
118+
steps:
119+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
120+
with:
121+
fetch-depth: 0
122+
123+
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
124+
if: ${{ secrets.GITEA_SSH_KEY != '' }}
125+
with:
126+
ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
127+
128+
- name: Mirror to Gitea
129+
run: |
130+
ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts
131+
git remote add gitea git@${{ vars.GITEA_HOST }}:${{ vars.GITEA_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
132+
git push --force gitea main
133+
134+
mirror-radicle:
135+
runs-on: ubuntu-latest
136+
timeout-minutes: 15
137+
if: vars.RADICLE_MIRROR_ENABLED == 'true'
138+
steps:
139+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
140+
with:
141+
fetch-depth: 0
142+
143+
- name: Setup Rust
144+
uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
145+
with:
146+
toolchain: stable
147+
148+
- name: Install Radicle
149+
run: |
150+
# Install via cargo (safer than curl|sh)
151+
cargo install radicle-cli --locked
152+
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
153+
154+
- name: Mirror to Radicle
155+
run: |
156+
echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
157+
chmod 600 ~/.radicle/keys/radicle
158+
rad sync --announce || echo "Radicle sync attempted"

‎.github/workflows/scorecard.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# SPDX-License-Identifier: PMPL-1.0
2+
name: OSSF Scorecard
3+
on:
4+
push:
5+
branches: [main, master]
6+
schedule:
7+
- cron: '0 4 * * *'
8+
workflow_dispatch:
9+
10+
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
11+
# updates do not pile up queued runs against the shared account-wide
12+
# Actions concurrency pool. Applied only to read-only check workflows
13+
# (no publish/mutation), so cancelling a superseded run is always safe.
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: true
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
analysis:
23+
runs-on: ubuntu-latest
24+
timeout-minutes: 15
25+
permissions:
26+
security-events: write
27+
id-token: write
28+
steps:
29+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
with:
31+
persist-credentials: false
32+
33+
- name: Run Scorecard
34+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1
35+
with:
36+
results_file: results.sarif
37+
results_format: sarif
38+
39+
- name: Upload results
40+
uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3.31.8
41+
with:
42+
sarif_file: results.sarif

‎.github/workflows/secret-scanner.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# SPDX-License-Identifier: PMPL-1.0
2+
# Prevention workflow - scans for hardcoded secrets before they reach main
3+
name: Secret Scanner
4+
5+
on:
6+
pull_request:
7+
push:
8+
branches: [main]
9+
10+
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
11+
# updates do not pile up queued runs against the shared account-wide
12+
# Actions concurrency pool. Applied only to read-only check workflows
13+
# (no publish/mutation), so cancelling a superseded run is always safe.
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: true
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
trufflehog:
23+
runs-on: ubuntu-latest
24+
timeout-minutes: 15
25+
steps:
26+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
27+
with:
28+
fetch-depth: 0 # Full history for scanning
29+
30+
- name: TruffleHog Secret Scan
31+
uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3
32+
with:
33+
# The v3 action injects --fail automatically on pull_request events.
34+
# Passing --fail here triggers "flag 'fail' cannot be repeated".
35+
extra_args: --only-verified
36+
37+
gitleaks:
38+
runs-on: ubuntu-latest
39+
timeout-minutes: 15
40+
steps:
41+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
42+
with:
43+
fetch-depth: 0
44+
45+
- name: Gitleaks Secret Scan
46+
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
47+
env:
48+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
49+
50+
# Rust-specific: Check for hardcoded crypto values
51+
rust-secrets:
52+
runs-on: ubuntu-latest
53+
timeout-minutes: 15
54+
steps:
55+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
56+
57+
- name: Check for hardcoded secrets in Rust
58+
run: |
59+
if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
60+
echo 'No Cargo.toml found — skipping Rust secrets check'
61+
exit 0
62+
fi
63+
# Patterns that suggest hardcoded secrets
64+
PATTERNS=(
65+
'const.*SECRET.*=.*"'
66+
'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
67+
'const.*TOKEN.*=.*"'
68+
'let.*api_key.*=.*"'
69+
'HMAC.*"[a-fA-F0-9]{32,}"'
70+
'password.*=.*"[^"]+"'
71+
)
72+
73+
found=0
74+
for pattern in "${PATTERNS[@]}"; do
75+
if grep -rn --include="*.rs" -E "$pattern" src/; then
76+
echo "WARNING: Potential hardcoded secret found matching: $pattern"
77+
found=1
78+
fi
79+
done
80+
81+
if [ $found -eq 1 ]; then
82+
echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
83+
exit 1
84+
fi

‎setup.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
# Then hands off to `just setup` for project-specific configuration.
77
#
88
# Usage:
9-
# curl -fsSL https://raw.githubusercontent.com/hyperpolymath/rsr-template-repo/main/setup.sh | sh
9+
# curl -fsSL https://raw.githubusercontent.com/hyperpolymath/rsr-template-repo/main/setup.sh -o setup.sh && sh setup.sh # review before running
1010
# # or after cloning:
1111
# ./setup.sh
1212
#
@@ -141,7 +141,7 @@ install_just() {
141141
dnf) sudo dnf install -y just ;;
142142
apt) sudo apt-get install -y just 2>/dev/null || {
143143
# just not in older apt repos — use installer
144-
curl -fsSL https://just.systems/install.sh | bash -s -- --to /usr/local/bin
144+
curl -fsSL https://just.systems/install.sh -o /tmp/just-install.sh && bash /tmp/just-install.sh --to /usr/local/bin
145145
} ;;
146146
pacman) sudo pacman -S --noconfirm just ;;
147147
apk) sudo apk add just ;;
@@ -153,7 +153,7 @@ install_just() {
153153
nix) nix-env -iA nixpkgs.just ;;
154154
*)
155155
info "Using just installer script..."
156-
curl -fsSL https://just.systems/install.sh | bash -s -- --to /usr/local/bin
156+
curl -fsSL https://just.systems/install.sh -o /tmp/just-install.sh && bash /tmp/just-install.sh --to /usr/local/bin
157157
;;
158158
esac
159159

0 commit comments

Comments
 (0)