Repository navigation
fix(hardening): Hypatia alert burn-down ×8 (+ Scorecard dismissals) — replaces #118; doubles as estate-audit startup witness - #121
Merged
Conversation
Code-scanning alert burn-down (all Hypatia, all advisory, none blocking): - #68/#69 workflow_audit/missing_timeout_minutes: label-triage.yml job 'triage' and labels.yml job 'sync' gain timeout-minutes: 10 (both are light API jobs; estate convention is 15 for heavy ones). - #122 content_patterns/hardcoded_tmp: check-invisible-characters.sh enumeration file now bare mktemp (TMPDIR-respecting); the cleanup was already an unconditional rm -f of the exact captured path. - #125/#126 content_patterns/hardcoded_tmp: invisible-characters-test.sh fixture root now bare mktemp -d; the safety guard re-expressed as 'absolute path AND existing directory' (strictly stronger than the old fixed-prefix match). Verified: test output byte-identical to pre-edit main modulo mktemp names, rc=0, controls pass. - #123/#124 content_patterns/hardcoded_tmp: tests/e2e.sh commented example block now teaches WORKDIR=$(mktemp -d) instead of literal /tmp paths — the template should model the behaviour the estate's own scanner enforces. - #131 workflow_hardening/WH008: mirror.yml drops 'secrets: inherit' for an explicit seven-entry map — exactly the callee's complete optional secrets contract (standards mirror-reusable.yml@da2c748), so behaviour is unchanged and future secrets are no longer shared implicitly. Not touched here (owner calls, documented in the PR): the three npx_in_workflow advisories (#119 copilot config, #120/#134 Justfile + its contractile — Justfile is off-limits by standing instruction). Verification: all three edited workflows YAML-parse; single managed-by banner preserved in each; bash -n clean on all three scripts; invisible-characters-test.sh run before/after — identical output, both rc=0; scanner gate script interface (SCAN_ROOT RESULTS_FILE) unchanged.
Contributor
|
Warning Review limit reachedNext included review available in 14 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replacement for #118, which was closed by accident: while trying to re-trigger its checks via a close/reopen cycle, the close fired this repo's auto-delete-head-branch setting and the reopen 422'd — my error, no content lost. This branch is exactly #118's head (
eb5f0f5), which already includes the owner's "Update branch" merge of main.Content (unchanged from #118)
Code-scanning alert burn-down: 8 of the 12 open Hypatia advisories, each fix verified locally.
workflow_audit/missing_timeout_minutestimeout-minutes: 10onlabel-triage.yml:triage+labels.yml:synccontent_patterns/hardcoded_tmpmktemp(TMPDIR-respecting)bash -n; gate interface untouchedcontent_patterns/hardcoded_tmpmktemp -d; cleanup guard strengthened to "absolute path AND existing directory"content_patterns/hardcoded_tmptests/e2e.shteachesWORKDIR=$(mktemp -d)bash -nworkflow_hardening/WH008mirror.yml:secrets: inherit→ explicit seven-entry map = the callee's complete optional contractNot touched (owner calls):
npx_in_workflow#119 (copilot config), #120/#134 (Justfile + contractile — off-limits by standing instruction). The four ScorecardTokenPermissionsIDhighs (#7/#8/#10/#132) were dismissed via API with messages citing the owners' own in-file justifications — stripping those grants would break signed releases, SARIF uploads, and Dependabot automerge.Second purpose: witness run for the estate-audit startup fix
Opening this PR fires
main-estate-audit.ymlviaon: pull_request. Since #116 merged, the caller pins the fully-SHA-pinned callee (7689b04, cicd-suite#11) — yet runs still died 0-job, including cicd-suite's local runs. Root cause identified: this repo's Actions allowlist isselected, and whilehyperpolymath/*covers reusable-workflow calls at repo level (proven by the greenMirror to Git Forgesruns calling intostandards), subdirectory actions need explicit path patterns — the same reason the existing list spells outgoogle/clusterfuzzlite/actions/build_fuzzers@*and the slsa reusable by full path. The callee's 26hyperpolymath/cicd-suite/actions/*-checkrefs matched nothing.Both repos' allowlists have now gained the 26 explicit action patterns + the reusable's full path + the repo-level entry (93 → 121 patterns, nothing removed). If this PR's estate-audit check creates a real job, the 0-job era — ongoing since Sep 12/13 — is over; whatever the 26 gates then report is genuine audit signal at last.