fix(ci): add trusted repository self-scan

kiyi commented

2026-09-04 16:35:31 -05:00

Member

The shared workflow repository did not run its own released security gate, so changes to scanner code could reach main without being evaluated by a trusted scanner implementation. This adds a repository caller that runs v1.1.0 on pull requests, main pushes, manual dispatches, and a weekly schedule. It also removes the unsupported GitHub permissions field from the Forgejo release workflow and updates examples to the current release.

Validation: 34 Python unit and contract tests passed; YAML, Bash, and 16 mocked scaffold cases passed; git diff --check passed.

Relates to #1, #3, and #4.

The shared workflow repository did not run its own released security gate, so changes to scanner code could reach main without being evaluated by a trusted scanner implementation. This adds a repository caller that runs v1.1.0 on pull requests, main pushes, manual dispatches, and a weekly schedule. It also removes the unsupported GitHub permissions field from the Forgejo release workflow and updates examples to the current release. Validation: 34 Python unit and contract tests passed; YAML, Bash, and 16 mocked scaffold cases passed; git diff --check passed. Relates to #1, #3, and #4.

kiyi added 1 commit

2026-09-04 16:35:31 -05:00

fix(ci): add trusted repository self-scan

Repository security / security-1 (pull_request) Failing after 1m41s

Details

Repository security / security (pull_request) Failing after 0s

Details

Library checks / tests (pull_request) Successful in 1m29s

Details

d7047c26d8

Run the released security gate for pull requests, main pushes, manual dispatches, and weekly schedules. Remove Forgejo's unsupported permissions declaration and update current release examples.

kiyi referenced this pull request

2026-09-04 16:35:50 -05:00

Add secret scanning for commits and Forgejo Actions #1

kiyi referenced this pull request

2026-09-04 16:36:16 -05:00

Establish versioned workflows reusable across organizations #3

kiyi referenced this pull request

2026-09-04 16:36:42 -05:00

Implement the standard security scan baseline #4

kiyi referenced this pull request

2026-09-04 16:36:54 -05:00

Implement build-once artifact publishing and controlled promotion #5

gitchegumi added 1 commit

2026-09-04 16:44:18 -05:00

fix(security): review self-scan findings

Repository security / security-1 (pull_request) Successful in 1m31s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 1m30s

Details

f9582e1a53

Add exact, expiring controls for the five reviewed network audit findings in the workflow library. Print sanitized finding and scanner-error summaries so failed Forgejo jobs are actionable without exposing source snippets or secret values.

kiyi commented

2026-09-04 16:44:31 -05:00

Author

Member

The first self-scan correctly found five blocking Semgrep audit warnings. The uploaded decision contained no secrets, Trivy findings, malware, or scanner errors. All five findings cover intentional controlled network operations: Forgejo release upload/API access, the post-deployment HTTPS health check, and checksum-verified Semgrep/tool downloads.

Commit f9582e1 adds exact mitigations owned by kiyi, linked to #4, expiring 2026-12-01, with a separate reason and compensating control for every fingerprint. The policy was evaluated against the downloaded decision: 0 blocking and 5 mitigated. It also changes future scan logs to print sanitized scanner/rule/path/line/fingerprint summaries and scanner errors without source snippets or secret values.

Validation: 35 unit/contract tests passed; YAML, Bash, and all 16 mocked gate cases passed in WSL; git diff --check passed.

The first self-scan correctly found five blocking Semgrep audit warnings. The uploaded decision contained no secrets, Trivy findings, malware, or scanner errors. All five findings cover intentional controlled network operations: Forgejo release upload/API access, the post-deployment HTTPS health check, and checksum-verified Semgrep/tool downloads. Commit f9582e1 adds exact mitigations owned by kiyi, linked to #4, expiring 2026-12-01, with a separate reason and compensating control for every fingerprint. The policy was evaluated against the downloaded decision: 0 blocking and 5 mitigated. It also changes future scan logs to print sanitized scanner/rule/path/line/fingerprint summaries and scanner errors without source snippets or secret values. Validation: 35 unit/contract tests passed; YAML, Bash, and all 16 mocked gate cases passed in WSL; git diff --check passed.