fix(ci): close the governance gate — SPDX, permissions, SHA pins, reu… #107
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | ||
|
Check failure on line 1 in .github/workflows/security-checks.yml
|
||
| # RSR-compliant security validation workflow with SHA-pinned actions | ||
| name: Security Checks | ||
| on: | ||
| push: | ||
| branches: ["main"] | ||
| pull_request: | ||
| branches: ["main"] | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| secret-scanning: | ||
| name: Detect Secrets | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Detect secrets with Gitleaks | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| dependency-review: | ||
| name: Dependency Review | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| if: github.event_name == 'pull_request' | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| - name: Dependency Review | ||
| uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.5.0 | ||
| with: | ||
| fail-on-severity: high | ||
| deny-licenses: GPL-3.0, AGPL-3.0 | ||
| comment-summary-in-pr: always | ||
| validate-actions: | ||
| name: Validate GitHub Actions | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| - name: Check for unpinned actions | ||
| run: | | ||
| echo "Checking for unpinned GitHub Actions..." | ||
| UNPINNED=$(grep -rE "uses:\s+[^@]+@(v[0-9]+|main|master|latest)" .github/workflows/ || true) | ||
| if [ -n "$UNPINNED" ]; then | ||
| echo "::warning::Found potentially unpinned actions (should use SHA pinning):" | ||
| echo "$UNPINNED" | ||
| else | ||
| echo "All actions appear to be SHA-pinned" | ||
| fi | ||
| - name: Check for dangerous permissions | ||
| run: | | ||
| echo "Checking for overly permissive workflow permissions..." | ||
| DANGEROUS=$(grep -rE "permissions:\s*write-all" .github/workflows/ || true) | ||
| if [ -n "$DANGEROUS" ]; then | ||
| echo "::error::Found workflows with write-all permissions:" | ||
| echo "$DANGEROUS" | ||
| exit 1 | ||
| fi | ||
| echo "No dangerous permissions found" | ||
| file-validation: | ||
| name: Validate Security Files | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
| - name: Check required security files exist | ||
| run: | | ||
| MISSING="" | ||
| for file in SECURITY.md LICENSE.txt .github/CODEOWNERS .github/dependabot.yml; do | ||
| if [ ! -f "$file" ]; then | ||
| MISSING="$MISSING $file" | ||
| fi | ||
| done | ||
| if [ -n "$MISSING" ]; then | ||
| echo "::error::Missing required security files:$MISSING" | ||
| exit 1 | ||
| fi | ||
| echo "All required security files present" | ||
| - name: Check for template placeholders | ||
| run: | | ||
| echo "Checking for unfilled template placeholders..." | ||
| PLACEHOLDERS=$(grep -rE "\{\{[A-Z_]+\}\}" SECURITY.md CONTRIBUTING.md 2>/dev/null || true) | ||
| if [ -n "$PLACEHOLDERS" ]; then | ||
| echo "::error::Found unfilled template placeholders:" | ||
| echo "$PLACEHOLDERS" | ||
| exit 1 | ||
| fi | ||
| echo "No template placeholders found" | ||
| trufflehog: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: TruffleHog Secret Scan | ||
| uses: trufflesecurity/trufflehog@main | ||
| with: | ||
| extra_args: --only-verified --fail | ||
