From fd3d5bc9ffa88da3c2dfa877aa6a5b1eb5a79f3e Mon Sep 17 00:00:00 2001 From: Shane da Silva Date: Thu, 17 Sep 2026 12:47:43 -0700 Subject: [PATCH 1/3] ci: add dependency and workflow security scans --- .github/workflows/ci.yml | 4 ++++ .github/workflows/dependency-scan.yml | 13 +++++++++++++ .github/workflows/release-tags.yml | 7 +++++-- .github/workflows/release.yml | 9 ++++++--- .github/workflows/scan-github-actions.yml | 16 ++++++++++++++++ 5 files changed, 44 insertions(+), 5 deletions(-) create mode 100644 .github/workflows/dependency-scan.yml create mode 100644 .github/workflows/scan-github-actions.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 630ded5..b9f00d0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -13,12 +13,16 @@ concurrency: permissions: contents: read + id-token: write jobs: ci: runs-on: ubuntu-latest timeout-minutes: 10 steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea + - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml new file mode 100644 index 0000000..30c2e17 --- /dev/null +++ b/.github/workflows/dependency-scan.yml @@ -0,0 +1,13 @@ +name: Dependency Scan + +"on": + pull_request: + +permissions: {} + +jobs: + dependency-scan: + uses: tempoxyz/gh-actions/.github/workflows/dependency-scan.yml@25cce154e7fb10f99361a166468a6c56b9c31aa3 + permissions: + contents: read + id-token: write diff --git a/.github/workflows/release-tags.yml b/.github/workflows/release-tags.yml index 2b875ff..3129bdd 100644 --- a/.github/workflows/release-tags.yml +++ b/.github/workflows/release-tags.yml @@ -6,12 +6,16 @@ on: permissions: contents: write + id-token: write jobs: update-tags: name: Update major version tag runs-on: ubuntu-latest steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea + - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: @@ -26,6 +30,7 @@ jobs: - name: Update major version tag env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} TAG: ${{ github.event.release.tag_name }} run: | # Extract major version (e.g., v1) @@ -65,5 +70,3 @@ jobs: echo "Tag $TAG does not match expected format (vX.Y.Z)" exit 1 fi - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6a153d6..a8a32de 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,6 +24,9 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: + - name: Secure runner + uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea + - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: @@ -79,18 +82,18 @@ jobs: # Wait for changeset tag to be available MAX_ATTEMPTS=10 SLEEP_SECONDS=2 - for i in $(seq 1 $MAX_ATTEMPTS); do + for i in $(seq 1 "$MAX_ATTEMPTS"); do git fetch --tags origin if git rev-parse "$CHANGESET_TAG" >/dev/null 2>&1; then echo "Changeset tag $CHANGESET_TAG found" break fi - if [ $i -eq $MAX_ATTEMPTS ]; then + if [ "$i" -eq "$MAX_ATTEMPTS" ]; then echo "Error: Tag $CHANGESET_TAG not found after $MAX_ATTEMPTS attempts" exit 1 fi echo "Attempt $i/$MAX_ATTEMPTS: Tag not yet available, waiting..." - sleep $SLEEP_SECONDS + sleep "$SLEEP_SECONDS" done # Create the vX.Y.Z tag pointing to the same commit diff --git a/.github/workflows/scan-github-actions.yml b/.github/workflows/scan-github-actions.yml new file mode 100644 index 0000000..55bc0dc --- /dev/null +++ b/.github/workflows/scan-github-actions.yml @@ -0,0 +1,16 @@ +name: Scan GitHub Actions + +"on": + pull_request: + +permissions: {} + +jobs: + scan: + name: Scan GitHub Actions + uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@6a4184039b7a7537d35ace0badc96764d5a1d4d0 + permissions: + actions: read + contents: read + id-token: write + security-events: write From 9e705242c6b500247568c1dbe93767a7624795de Mon Sep 17 00:00:00 2001 From: Shane da Silva Date: Thu, 17 Sep 2026 12:49:30 -0700 Subject: [PATCH 2/3] ci: trust system certificates in Node jobs --- .github/workflows/ci.yml | 2 ++ .github/workflows/release.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b9f00d0..133b382 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,6 +19,8 @@ jobs: ci: runs-on: ubuntu-latest timeout-minutes: 10 + env: + NODE_USE_SYSTEM_CA: "1" steps: - name: Secure runner uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a8a32de..cea0856 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,6 +23,8 @@ jobs: name: Release runs-on: ubuntu-latest timeout-minutes: 10 + env: + NODE_USE_SYSTEM_CA: "1" steps: - name: Secure runner uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea From 7d9dc2371c2dfc29691300f4fb8da022cb7627fa Mon Sep 17 00:00:00 2001 From: Shane da Silva Date: Thu, 17 Sep 2026 12:51:48 -0700 Subject: [PATCH 3/3] ci: pass action inputs through the environment --- action.yml | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/action.yml b/action.yml index 7be7393..9a686ca 100644 --- a/action.yml +++ b/action.yml @@ -85,28 +85,34 @@ runs: id: run-lint shell: bash working-directory: ${{ github.workspace }} + env: + EXCLUDE_RULES: ${{ inputs.exclude-rules }} + FIX: ${{ inputs.fix }} + LANGUAGE: ${{ inputs.language }} + POST_COMMENT: ${{ inputs.post-comment }} + SCAN_PATH_INPUT: ${{ inputs.path }} run: | # Resolve scan path (default to workspace root) - SCAN_PATH="${{ inputs.path }}" + SCAN_PATH="$SCAN_PATH_INPUT" if [ "$SCAN_PATH" = "." ]; then SCAN_PATH="${{ github.workspace }}" fi # Build CLI args - use JSON output if PR comment is needed - if [ "${{ inputs.post-comment }}" = "true" ] && [ "${{ github.event_name }}" = "pull_request" ]; then + if [ "$POST_COMMENT" = "true" ] && [ "${{ github.event_name }}" = "pull_request" ]; then OUTPUT_FORMAT="--json" else OUTPUT_FORMAT="--github-action" fi # Build CLI args array for safe parameter passing - CLI_ARGS=("${{ inputs.language }}" "$SCAN_PATH" "$OUTPUT_FORMAT") + CLI_ARGS=("$LANGUAGE" "$SCAN_PATH" "$OUTPUT_FORMAT") - if [ -n "${{ inputs.exclude-rules }}" ]; then - CLI_ARGS+=("--exclude" "${{ inputs.exclude-rules }}") + if [ -n "$EXCLUDE_RULES" ]; then + CLI_ARGS+=("--exclude" "$EXCLUDE_RULES") fi - if [ "${{ inputs.fix }}" = "true" ]; then + if [ "$FIX" = "true" ]; then CLI_ARGS+=("--fix") fi @@ -144,14 +150,14 @@ runs: shell: bash env: GITHUB_TOKEN: ${{ inputs.github-token }} + LANGUAGE: ${{ inputs.language }} + OUTPUT_FILE: ${{ steps.run-lint.outputs.output_file }} run: | if [ -z "$GITHUB_TOKEN" ]; then echo "::warning::github-token is required for posting PR comments" exit 0 fi - OUTPUT_FILE="${{ steps.run-lint.outputs.output_file }}" - # Validate output file exists if [ ! -f "$OUTPUT_FILE" ]; then echo "::error::Output file not found at $OUTPUT_FILE" @@ -166,13 +172,14 @@ runs: "$TOTAL_ISSUES" \ "${{ github.repository }}" \ "${{ github.event.pull_request.number }}" \ - "${{ inputs.language }}" + "$LANGUAGE" - name: Check for failures if: inputs.fail-on-error == 'true' shell: bash + env: + EXIT_CODE: ${{ steps.run-lint.outputs.exit_code }} run: | - EXIT_CODE="${{ steps.run-lint.outputs.exit_code }}" if [ "$EXIT_CODE" != "0" ]; then echo "::error::Lint errors found. Fix the issues above or set fail-on-error to false." exit 1