mirror of
https://github.com/secondsky/claude-skills.git
synced 2026-09-18 19:54:22 +08:00
Eddie
1af2269ecc
* fix(ci): harden live workflows — persist-credentials off, job timeouts, concurrency groups * ci: add blocking zizmor gate — SHA-pinned action, online audits, scans live workflows + shipped templates * ci: dependabot cooldown + explicit CODEOWNERS guard for workflow edits * fix(templates): close template-injection + cache-poisoning in shipped workflows - pr-checks.yml: pass head_ref, PR SHAs, number and mergeable state via env instead of interpolating event data into run: scripts (the HIGH template-injection via attacker-controlled branch names); quote all expansions so shellcheck is clean - release.yml: disable dependency caching in the release/publish path (cache-poisoning hardening); replace third-party action-gh-release with the first-party gh CLI (zizmor superfluous-actions); document the trusted-publishing tradeoff for npm publish - scheduled-maintenance.yml: quote expansions in cache-cleanup and health-check scripts All six HIGH baseline findings and the actionlint script-injection warning are resolved; release.yml is now informational-clean. * fix(templates): SHA-pin all action refs to current verified releases Resolve every uses: in the 12 shipped workflow templates to a full 40-hex commit SHA with a tag comment. Replaces the known-vulnerable github/codeql-action v3.27.4 pins (GHSA-vqf5-2xx6-9wfm) with the same v4.37.6 pin the live workflows use, aligns checkout with v7.0.1 and dependency-review-action with v5.0.0, and bumps setup-node v5.0.0, setup-python v6.3.0, upload-artifact v5.0.0, download-artifact v6.0.0, codecov-action v5.5.5. SHAs resolved via git ls-remote, annotated tags dereferenced. * fix(templates): least-privilege permissions, timeouts, concurrency everywhere Add to all 12 shipped workflow templates: - explicit least-privilege workflow-level permissions (contents: read is the norm; job-level scopes: contents: write only for the release publisher, pull-requests: read for label inspection, pull-requests: write for dependency-review PR comments, actions: write for cache cleanup, security-events: write for CodeQL SARIF uploads) - timeout-minutes on every job (10 validate / 15 build+test / 20-30 release and CodeQL/CD) - concurrency groups matching the live workflows, with cancel-in-progress: false for the scheduled maintenance template - persist-credentials: false on every checkout — no template ships a git push; releases are created via the GITHUB_TOKEN API - pass github.sha through env in the cd-production summary step Closes all 47 medium baseline findings (27 excessive-permissions + 20 artipacked); full zizmor scan of the templates now reports no findings.
25 lines
525 B
YAML
25 lines
525 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
npm-minor:
|
|
update-types: ["minor", "patch"]
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
actions-minor:
|
|
update-types: ["minor", "patch"]
|