From 126b7756627977c4dfbf87349911adeb1932955d Mon Sep 17 00:00:00 2001 From: Nathan Agrin Date: Tue, 12 May 2026 09:14:37 -0700 Subject: [PATCH 1/3] ci: pin third-party actions to commit SHAs Replace floating tag refs (e.g. `actions/checkout@v4`) with full commit SHAs so a compromised upstream action repo cannot retroactively poison our workflow runs. Tag in trailing comment is informational. Pins: - actions/checkout@34e1148 # v4.3.1 - actions/setup-go@40f1582 # v5.6.0 - goreleaser/goreleaser-action@e435ccd # v6.4.0 - peter-evans/repository-dispatch@ff45666 # v3.0.0 Motivated by the TanStack npm supply-chain compromise postmortem. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/lint.yml | 4 ++-- .github/workflows/notify-docs.yml | 2 +- .github/workflows/notify-downstream.yml | 2 +- .github/workflows/release.yml | 8 ++++---- .github/workflows/test.yml | 4 ++-- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index c4ba800..164ba21 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -8,9 +8,9 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod diff --git a/.github/workflows/notify-docs.yml b/.github/workflows/notify-docs.yml index 0f61d07..4bad2e0 100644 --- a/.github/workflows/notify-docs.yml +++ b/.github/workflows/notify-docs.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Trigger mintlify-omni docs sync - uses: peter-evans/repository-dispatch@v3 + uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0 with: token: ${{ secrets.DOCS_REPO_TOKEN }} repository: exploreomni/mintlify-omni diff --git a/.github/workflows/notify-downstream.yml b/.github/workflows/notify-downstream.yml index 031a3e0..98e3e1a 100644 --- a/.github/workflows/notify-downstream.yml +++ b/.github/workflows/notify-downstream.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Trigger omni-agent-skills sync - uses: peter-evans/repository-dispatch@v3 + uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0 with: token: ${{ secrets.SKILLS_REPO_TOKEN }} repository: exploreomni/omni-agent-skills diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1692f1b..7e93cf0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,16 +12,16 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: fetch-depth: 0 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod - name: Run GoReleaser (release artifacts only) - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 with: version: "~> v2" args: release --clean @@ -30,7 +30,7 @@ jobs: - name: Checkout Homebrew tap if: ${{ !contains(github.ref_name, '-') }} - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: exploreomni/homebrew-tap ref: main diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b6540ec..5c28bdb 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -10,9 +10,9 @@ jobs: test: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - uses: actions/setup-go@v5 + - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod From 13380d389b8e2aea0b1fa6baf3c8c3aad7c59f9f Mon Sep 17 00:00:00 2001 From: Nathan Agrin Date: Tue, 12 May 2026 09:14:59 -0700 Subject: [PATCH 2/3] ci: add minimum top-level permissions to workflows Set least-privilege defaults so a compromised action step receives the smallest possible GITHUB_TOKEN scope. - lint.yml, test.yml: contents: read (only need to checkout source) - notify-docs.yml, notify-downstream.yml: {} (use a PAT for the cross-repo dispatch; GITHUB_TOKEN is not used) - release.yml: already declares contents: write at the workflow level Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/lint.yml | 3 +++ .github/workflows/notify-docs.yml | 2 ++ .github/workflows/notify-downstream.yml | 2 ++ .github/workflows/test.yml | 3 +++ 4 files changed, 10 insertions(+) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 164ba21..554777e 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -4,6 +4,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: lint: runs-on: ubuntu-latest diff --git a/.github/workflows/notify-docs.yml b/.github/workflows/notify-docs.yml index 4bad2e0..02674e3 100644 --- a/.github/workflows/notify-docs.yml +++ b/.github/workflows/notify-docs.yml @@ -9,6 +9,8 @@ on: - "**/*.md" - "!.github/**" +permissions: {} + jobs: notify: runs-on: ubuntu-latest diff --git a/.github/workflows/notify-downstream.yml b/.github/workflows/notify-downstream.yml index 98e3e1a..a1c373a 100644 --- a/.github/workflows/notify-downstream.yml +++ b/.github/workflows/notify-downstream.yml @@ -4,6 +4,8 @@ on: release: types: [published] +permissions: {} + jobs: notify: runs-on: ubuntu-latest diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 5c28bdb..056d2d8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -6,6 +6,9 @@ on: push: branches: [main] +permissions: + contents: read + jobs: test: runs-on: ubuntu-latest From e23ea067269c1e715ee145f3aa78f040bce71e13 Mon Sep 17 00:00:00 2001 From: Nathan Agrin Date: Tue, 12 May 2026 09:15:12 -0700 Subject: [PATCH 3/3] install.sh: fail closed when no sha256 tool is available Previously the installer printed a warning and continued without verifying the downloaded archive against checksums.txt. That turned a MITM-resistant install into an unverified curl|sh in the edge case where neither sha256sum nor shasum is present. Exit non-zero instead so users explicitly opt in to skipping verification. Co-Authored-By: Claude Opus 4.7 (1M context) --- install.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/install.sh b/install.sh index 5b7e70e..9df3c86 100755 --- a/install.sh +++ b/install.sh @@ -99,8 +99,8 @@ verify_checksum() { elif command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "${dir}/${file}" | awk '{print $1}') else - echo "Warning: No sha256 tool found, skipping checksum verification" >&2 - return + echo "Error: No sha256 tool found (need sha256sum or shasum); refusing to install without checksum verification" >&2 + exit 1 fi if [ "$expected" != "$actual" ]; then