ci(governance): harden workflows — timeouts, perms, secret gate, codeql actions, drop privileged workflow_run (Part B) by hyperpolymath · Pull Request #25 · hyperpolymath/gv-clade-index

hyperpolymath · 2026-06-21T10:48:02Z

Why

Part B of the in-repo hygiene work ("2 then 1"). Clears the pre-existing Hypatia workflow_audit findings that surface on every PR (1 critical / several high / mediums). These are non-blocking today but make the governance scan noisy; this tidies them.

Changes

Finding	Severity	Fix
`missing_timeout_minutes`	medium	Added `timeout-minutes` to every remaining job: `release.yml` (3), `static-analysis-gate.yml` (3), `rhodibot.yml` (1)
`secret_action_without_presence_gate` (`instant-sync.yml`)	high	Gate the `repository-dispatch` step on `secrets.FARM_DISPATCH_TOKEN != ''` so it no-ops without the secret
`scorecard_wrapper_missing_job_permissions` (`scorecard.yml`)	high	Added job-level `permissions:` (security-events / id-token / contents / actions) to the reusable-wrapper job
`codeql_missing_actions_language` (`codeql.yml`)	medium	Added the `actions` language to the matrix so workflow files are scanned
privileged `workflow_run` (`rhodibot.yml`)	critical	Removed the `workflow_run` trigger — it ran with `contents`/`pull-requests: write` on Hypatia completion. Rhodibot still runs via `schedule` (weekly) + `workflow_dispatch`

Note on the rhodibot critical

Rhodibot only ever checked out the default branch and ran its own hardcoded script (not PR code), so it wasn't a classic pwn-request — but Hypatia flags privileged workflow_run, and dropping it is the cleanest fix. If you'd rather keep the auto-run-after-Hypatia behaviour with a conclusion == 'success' guard instead, say so and I'll switch.

Verified

All changed workflows parse as YAML; every non-reusable job now has timeout-minutes.
rhodibot.yml has no remaining workflow_run: trigger key.

Still out of scope (needs you, upstream)

Check Workflow Staleness will remain red until actions/cache is repinned in hyperpolymath/standards's hypatia-scan-reusable.yml (the diff I provided earlier) — then I'll forward-bump the pins here and that goes green too.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

Generated by Claude Code

…gate, codeql actions, drop privileged workflow_run Clears the pre-existing Hypatia workflow_audit findings (non-blocking, but tidies governance CI): - timeout-minutes on all remaining jobs: release.yml (3), static-analysis-gate.yml (3), rhodibot.yml (1) - instant-sync.yml (HIGH secret_action_without_presence_gate): gate the repository-dispatch step on FARM_DISPATCH_TOKEN presence so it no-ops without the secret - scorecard.yml (HIGH scorecard_wrapper_missing_job_permissions): add job-level permissions to the reusable-wrapper job (security-events/id-token/contents/actions) - codeql.yml (codeql_missing_actions_language): add the `actions` language so workflow files are scanned - rhodibot.yml (CRITICAL): remove the privileged `workflow_run` trigger — it ran with contents/ pull-requests write on Hypatia completion; rhodibot still runs via schedule + workflow_dispatch Verified: all changed workflows parse as YAML; every non-reusable job now has timeout-minutes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

github-advanced-security · 2026-06-21T10:48:44Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

github-actions · 2026-06-21T10:48:55Z

🔍 Hypatia Security Scan

Findings: 30 issues detected

Severity	Count
🔴 Critical	1
🟠 High	6
🟡 Medium	23

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Download-and-execute pattern (curl|wget pipe to shell) -- verify integrity before execution (3 occurrences, CWE-494)",
    "type": "shell_download_then_run",
    "file": "/home/runner/work/gv-clade-index/gv-clade-index/setup.sh",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "line": 24,
    "reason": "Secret found: Generic API key",
    "type": "secret_detected",
    "file": "/home/runner/work/gv-clade-index/gv-clade-index/.envrc",
    "action": "revoke_rotate_and_purge",
    "rule_module": "security_errors",
    "severity": "critical"
  },
  {
    "reason": "1 workflow(s) with tag-pinned (not SHA-pinned) actions in gv-clade-index",
    "type": "DependencyPinning",
    "file": "/home/runner/work/gv-clade-index/gv-clade-index",
    "action": "auto_fix",
    "rule_module": "scorecard",
    "severity": "medium",
    "remediation": "Pin GitHub Actions and Docker base images by SHA hash.",
    "scorecard_check": "Pinned-Dependencies"
  },
  {
    "reason": "Repository has 5 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 0 day(s) old",
    "type": "CSA001",
    "file": "docs/practice/AI-CONVENTIONS.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 0 day(s) old",
    "type": "CSA001",
    "file": "docs/developer/ABI-FFI-README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 14 day(s) old",
    "type": "CSA001",
    "file": "docs/governance/MAINTENANCE-CHECKLIST.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 14 day(s) old",
    "type": "CSA001",
    "file": "docs/RSR_OUTLINE.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 14 day(s) old",
    "type": "CSA001",
    "file": "QUICKSTART-DEV.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

… setup.sh, .envrc (#27) Addresses the actionable subset of the Hypatia advisory findings surfaced by the scanner upgrade in #26. The remaining ~7 are scanner false-positives (WF017 two-step gate, SC-013 comment stripping, SC-014 codeql substring) for an upstream fix. Docs (structural_drift SD022 x6 — stale path after #20's FFI removal): - correct `src/abi/` -> the real RSR slot `src/interface/abi/` in AI-CONVENTIONS, RSR_OUTLINE, QUICKSTART-DEV, MAINTENANCE-CHECKLIST, INTENT.contractile - replace the unfilled-template docs/developer/ABI-FFI-README.adoc (it still carried a `{{project}}` placeholder and a template-instruction line and described a non-existent FFI surface) with an honest "no FFI surface" stub pointing at the RSR placeholders and PROOF-NEEDS.md setup.sh (code_safety shell_download_then_run / CWE-494): - replace `curl ... just.systems/install.sh | bash` with a download-then-run helper (no pipe-to-shell), with opt-in JUST_VERSION pin and JUST_INSTALL_SHA256 verify; native package managers (incl. nix/guix) are still tried first - update the header usage example to the download-then-run form .envrc (secret_detected "Generic API key" — false-positive, commented placeholder): - remove the residual `# export DATABASE_URL=...` / `# export API_KEY=...` lines (re-lands the fix intended in #25 that never reached main) This does not by itself turn the hypatia check green — that needs the upstream reusable to restore `--exit-zero`/`|| true` on the scan step so it follows its documented advisory ("warn but don't fail") policy. Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR Co-authored-by: Claude <noreply@anthropic.com>

hyperpolymath marked this pull request as ready for review June 21, 2026 10:51

hyperpolymath merged commit 8ffcf33 into main Jun 21, 2026
14 of 15 checks passed

hyperpolymath deleted the claude/workflow-hardening branch June 21, 2026 10:51

hyperpolymath mentioned this pull request Jun 21, 2026

chore: clear genuine Hypatia findings (stale src/abi docs, setup.sh, .envrc) #27

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci(governance): harden workflows — timeouts, perms, secret gate, codeql actions, drop privileged workflow_run (Part B) - #25

ci(governance): harden workflows — timeouts, perms, secret gate, codeql actions, drop privileged workflow_run (Part B)#25
hyperpolymath merged 1 commit into
mainfrom
claude/workflow-hardening

hyperpolymath commented Jun 21, 2026

Uh oh!

github-advanced-security AI commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

hyperpolymath commented Jun 21, 2026

Why

Changes

Note on the rhodibot critical

Verified

Still out of scope (needs you, upstream)

Uh oh!

github-advanced-security AI commented Jun 21, 2026

What Enabling Code Scanning Means:

Uh oh!

github-actions Bot commented Jun 21, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants