From 936c66f90d853585ecd4cf38f57f11460af4cf85 Mon Sep 17 00:00:00 2001 From: Jami Couch Date: Thu, 18 Jun 2026 20:10:51 -0500 Subject: [PATCH 1/2] [verify-github-namespace] fix: treat github/* as a verified first-party publisher GitHub's own `github/*` org (e.g. `github/codeql-action`) is documented in the README as a verified publisher, but `check_verified_publisher()` only hardcoded the `actions` namespace. Because GitHub does not badge its own org as a third-party "partner organization" on the Marketplace, the scrape-based fallback could never confirm `github/*`, producing spurious "Not from verified publisher" failures for first-party actions like CodeQL. Add `github` alongside `actions` in the always-verified branch, matching the existing precedent (v1.4.2) and the behavior the README already promises. - Add `test-github-namespace` CI job + test workflow asserting github/* is verified without any allowlist entry. - Document the fix under an Unreleased CHANGELOG section. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/test.yml | 41 +++++++++++++++++++++++- CHANGELOG.md | 5 +++ audit_actions.py | 7 ++-- test-workflows/github-namespace-test.yml | 14 ++++++++ 4 files changed, 64 insertions(+), 3 deletions(-) create mode 100644 test-workflows/github-namespace-test.yml diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7435192..833eb2f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -287,4 +287,43 @@ jobs: exit 1 fi - echo "✅ Allowlist logic working correctly (bypasses publisher check, enforces pinning)" \ No newline at end of file + echo "✅ Allowlist logic working correctly (bypasses publisher check, enforces pinning)" + + test-github-namespace: + name: Test GitHub First-Party Namespace + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + + - name: Create isolated test directory + run: | + mkdir -p test-github-namespace-workflows + cp test-workflows/github-namespace-test.yml test-github-namespace-workflows/ + + - name: Run Security Audit (no allowlist) + id: audit + uses: ./ + with: + github_token: ${{ secrets.GITHUB_TOKEN }} + workflows_dir: test-github-namespace-workflows + + - name: Verify GitHub Namespace Is Verified + run: | + echo "📋 Audit Report:" + cat action-security-report.md + + # github/* is a first-party GitHub org and must be treated as a + # verified publisher WITHOUT needing an allowlist entry. + if ! grep -A10 "github/codeql-action/init" action-security-report.md | grep -q "Verified Publisher.*✅"; then + echo "❌ Expected github/codeql-action to be a verified publisher" + exit 1 + fi + + # The whole run should pass (both actions pinned + first-party). + if [ "${{ steps.audit.outputs.exit_code }}" != "0" ]; then + echo "❌ Expected audit to pass for github first-party actions" + exit 1 + fi + + echo "✅ github first-party namespace verified correctly" \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 124112d..87fc75f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [Unreleased] + +### Fixed +- **`github` namespace always verified**: GitHub's own `github/*` org (e.g. `github/codeql-action`) is now unconditionally trusted, matching the existing treatment of `actions/*` and the verified-publisher list already documented in the README. GitHub does not apply the third-party "partner organization" badge to its own first-party org, so the Marketplace scrape could not confirm it, producing spurious "Not from verified publisher" failures for first-party actions like CodeQL. + ## [1.4.2] - 2026-03-11 ### Fixed diff --git a/audit_actions.py b/audit_actions.py index 2cc2f8b..dba8424 100644 --- a/audit_actions.py +++ b/audit_actions.py @@ -148,8 +148,11 @@ def is_commit_hash(self, version: str) -> bool: def check_verified_publisher(self, owner: str, action_name: str = None) -> bool: """Check if the action owner is a verified publisher by fetching repo page and finding marketplace link.""" - # GitHub's own 'actions' namespace is always verified - if owner == 'actions': + # GitHub's own first-party namespaces are always verified. GitHub + # does not badge its own org as a third-party "partner organization" + # on the Marketplace, so the scrape-based check below cannot confirm + # them. Both are already documented as verified publishers in README. + if owner in ('actions', 'github'): return True # Return cached result (covers both verified and non-verified outcomes) diff --git a/test-workflows/github-namespace-test.yml b/test-workflows/github-namespace-test.yml new file mode 100644 index 0000000..f299e51 --- /dev/null +++ b/test-workflows/github-namespace-test.yml @@ -0,0 +1,14 @@ +name: GitHub First-Party Namespace Test +on: [push] +jobs: + github-first-party: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + + - name: Initialize CodeQL + uses: github/codeql-action/init@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3 From 5b18a7ee81a09cb7b4b047f06f8aebbf270f1d67 Mon Sep 17 00:00:00 2001 From: Jami Couch Date: Thu, 18 Jun 2026 20:13:20 -0500 Subject: [PATCH 2/2] [verify-github-namespace] chore: drop github-namespace CI test; cut 1.4.3 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/test.yml | 41 +----------------------- CHANGELOG.md | 2 +- test-workflows/github-namespace-test.yml | 14 -------- 3 files changed, 2 insertions(+), 55 deletions(-) delete mode 100644 test-workflows/github-namespace-test.yml diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 833eb2f..7435192 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -287,43 +287,4 @@ jobs: exit 1 fi - echo "✅ Allowlist logic working correctly (bypasses publisher check, enforces pinning)" - - test-github-namespace: - name: Test GitHub First-Party Namespace - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - - name: Create isolated test directory - run: | - mkdir -p test-github-namespace-workflows - cp test-workflows/github-namespace-test.yml test-github-namespace-workflows/ - - - name: Run Security Audit (no allowlist) - id: audit - uses: ./ - with: - github_token: ${{ secrets.GITHUB_TOKEN }} - workflows_dir: test-github-namespace-workflows - - - name: Verify GitHub Namespace Is Verified - run: | - echo "📋 Audit Report:" - cat action-security-report.md - - # github/* is a first-party GitHub org and must be treated as a - # verified publisher WITHOUT needing an allowlist entry. - if ! grep -A10 "github/codeql-action/init" action-security-report.md | grep -q "Verified Publisher.*✅"; then - echo "❌ Expected github/codeql-action to be a verified publisher" - exit 1 - fi - - # The whole run should pass (both actions pinned + first-party). - if [ "${{ steps.audit.outputs.exit_code }}" != "0" ]; then - echo "❌ Expected audit to pass for github first-party actions" - exit 1 - fi - - echo "✅ github first-party namespace verified correctly" \ No newline at end of file + echo "✅ Allowlist logic working correctly (bypasses publisher check, enforces pinning)" \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 87fc75f..e2f820f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -## [Unreleased] +## [1.4.3] - 2026-06-18 ### Fixed - **`github` namespace always verified**: GitHub's own `github/*` org (e.g. `github/codeql-action`) is now unconditionally trusted, matching the existing treatment of `actions/*` and the verified-publisher list already documented in the README. GitHub does not apply the third-party "partner organization" badge to its own first-party org, so the Marketplace scrape could not confirm it, producing spurious "Not from verified publisher" failures for first-party actions like CodeQL. diff --git a/test-workflows/github-namespace-test.yml b/test-workflows/github-namespace-test.yml deleted file mode 100644 index f299e51..0000000 --- a/test-workflows/github-namespace-test.yml +++ /dev/null @@ -1,14 +0,0 @@ -name: GitHub First-Party Namespace Test -on: [push] -jobs: - github-first-party: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - - - name: Initialize CodeQL - uses: github/codeql-action/init@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3