Skip to content

ci security #1612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
daniel-noland merged 20 commits into from
Jul 7, 2026
Merged

ci security #1612

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
eaa815c
ci: pin GitHub Actions and reusable workflows to commit SHAs
daniel-noland Jul 2, 2026
0677d07
fix(ci): scope workflow permissions and tokens to least privilege
daniel-noland Jul 1, 2026
6506051
chore(ci): address zizmor pedantic findings
daniel-noland Jul 1, 2026
2b4edad
refactor(just): split lint into clippy/opengrep/pinact/zizmor recipes
daniel-noland Jul 1, 2026
22625b2
ci: consolidate lint-*.yml checks into a single dev.yml job
daniel-noland Jul 2, 2026
c593734
fix(ci): lint commit messages with commitlint-rs in the lint job
daniel-noland Jul 1, 2026
d93771e
fix(ci): report all failing lints, not just the first one
daniel-noland Jul 1, 2026
a356c93
ci: automate cargo and action version bumps via just recipes
daniel-noland Jul 2, 2026
41b05af
ci: increase cross compile parallel
daniel-noland Jul 1, 2026
9ee8e19
bump!: regular dependency update
daniel-noland Jul 7, 2026
6fa5347
bump(cargo)!: bump crossbeam-utils (cargo upgrade)
daniel-noland Jul 7, 2026
94f1463
bump(cargo)!: bump inotify (cargo upgrade)
daniel-noland Jul 7, 2026
09f8238
bump(cargo)!: bump reedline (cargo upgrade)
daniel-noland Jul 7, 2026
fe68b33
ci: remove distinct commitlint job
daniel-noland Jul 7, 2026
a9363e4
ci: remove unsupported block from actionlint.yml
daniel-noland Jul 7, 2026
8afd30f
bump!: regular dependency update
daniel-noland Jul 7, 2026
b003b78
bump(cargo)!: bump pyroscope (cargo upgrade)
daniel-noland Jul 7, 2026
fd4e26e
ci: reduce memory usage on fuzz builds
daniel-noland Jul 7, 2026
873c90f
ci: use fuzz profile in shuttle tests
daniel-noland Jul 7, 2026
c029290
build: reduce max parallelism in LTO linking
daniel-noland Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .commitlintrc.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
# Config for commitlint-rs
rules:
type:
level: error
options:
- build
- bump
- chore
- ci
- docs
- feat
- fix
- perf
- refactor
- revert
- style
- test
type-empty:
level: error
subject-empty:
level: error
description-empty:
level: error
description-format:
level: error
format: "^.*[^.]$"
description-max-length:
level: error
length: 72
Comment on lines +24 to +29

@coderabbitai coderabbitai Bot Jul 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

What rules does commitlint-rs (KeisukeYamashita/commitlint-rs) support, specifically description-format and description-max-length?

💡 Result:

The commitlint-rs project (KeisukeYamashita/commitlint-rs) does not natively support rules named description-format or description-max-length [1][2][3]. In the context of commitlint-rs, the commit message header is typically referred to as the subject [1][4]. While the tool supports various configuration rules for subject and body validation, these specific identifiers (description-format and description-max-length) are not part of its standard rule set [1][3][4]. Users commonly confuse commitlint-rs with other tools like cargo-commitlint (which is a separate project) or the Node-based commitlint [4][5]. For example, cargo-commitlint provides rules such as header-max-length and subject-case, but does not use the specific names you queried [4][5]. If you are looking to enforce length or format constraints on the commit subject in commitlint-rs, you should consult the project's official rule documentation [3], which details the rules currently implemented in the library. As of the latest available information, there is no evidence of "description" being used as a rule prefix in this tool [1][3].

Citations:

Use commitlint-rs rule names here

description-format and description-max-length are not recognized by commitlint-rs, so these checks won’t run. Rename them to the supported rule keys for the message part you want to validate.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.commitlintrc.yaml around lines 24 - 29, The commitlint-rs config is using
unsupported rule keys in the message description section, so these checks will
not run. Update the rule names in .commitlintrc.yaml from description-format and
description-max-length to the commitlint-rs-supported subject-related keys,
keeping the same format and length constraints. Use the existing rule block in
the config as the place to swap the names while preserving their level and
validation values.

7 changes: 0 additions & 7 deletions .github/actionlint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,6 @@ self-hosted-runner:
labels:
- "lab"

checker:
run-step-shellcheck: true
run-step-pyflakes: true
check-env: true
check-actions: true
check-outputs: true

paths:
.github/workflows/*.yml:
ignore:
Expand Down
2 changes: 1 addition & 1 deletion .github/actions/nix-setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ runs:
using: "composite"
steps:
- name: "login to ghcr.io"
uses: "docker/login-action@v4"
uses: "docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee" # v4.2.0
with:
registry: "ghcr.io"
username: "${{ github.actor }}"
Expand Down
6 changes: 3 additions & 3 deletions .github/actions/nix-shell/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,12 @@ runs:
using: "composite"
steps:
- name: "Install nix"
uses: "cachix/install-nix-action@v31"
uses: "cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3" # v31.10.6
with:
github_access_token: "${{ github.token }}"
nix_path: "nixpkgs=channel:nixpkgs-unstable"

- uses: "cachix/cachix-action@v17"
- uses: "cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71" # v17
with:
name: "hedgehog"
# prettier-ignore
Expand All @@ -34,6 +34,6 @@ runs:
authToken: '${{ inputs.cachix_auth_token }}'

- name: "use nix shell"
uses: "rrbutani/use-nix-shell-action@v1"
uses: "rrbutani/use-nix-shell-action@59a52b2b9bbfe3cc0e7deb8f9059abe37a439edf" # v1.1.0
with:
file: "shell.nix"
2 changes: 1 addition & 1 deletion .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ updates:
schedule:
interval: "weekly"
cooldown:
default-days: 7
default-days: 10
labels:
- "automated"
- "dependencies"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ Production artifacts are produced via nix builds in a separate CI workflow.
4. Execute tests:
- Regular tests using `cargo nextest` (via `just test`)
- Shuttle tests (concurrent execution testing with `features=shuttle`)
5. Run `cargo clippy` for linting (via `just lint`)
5. Run `cargo clippy` for linting (via `just clippy`)
6. Build documentation with `rustdoc` (via `just docs`)
7. Run doctests (via `just doctest`)
8. Push container images to GHCR (for non-test targets)
Expand Down
107 changes: 27 additions & 80 deletions .github/workflows/bump.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,27 +21,30 @@ concurrency:
cancel-in-progress: true

permissions:
contents: "write"
packages: "read"
id-token: "write"
pull-requests: "write"
contents: "read"

jobs:
cargo-upgrades:
name: "Check for cargo dependency upgrades"
runs-on: "lab"
env:
USER: "runner"
JUST_VARS: ""
steps:
# Use a GitHub App token so that the generated PR can trigger CI
- name: "Generate GitHub App token"
id: "app-token"
uses: "actions/create-github-app-token@v3"
uses: "actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1" # v3.2.0
with:
app-id: "${{ secrets.DP_APP_ID }}"
client-id: "${{ secrets.DP_APP_ID }}"
Comment thread
daniel-noland marked this conversation as resolved.
private-key: "${{ secrets.DP_PRIVATE_KEY }}"
permission-contents: "write"
permission-pull-requests: "write"

- name: "Checkout"
uses: "actions/checkout@v7"
uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
with:
persist-credentials: false

- uses: "./.github/actions/nix-shell"
with:
Expand All @@ -56,7 +59,7 @@ jobs:
bash scripts/bump.sh
if ! git diff --quiet; then
git add -u
git commit -sm "bump: pins"
git commit -sm "bump(nix)!: nix pins"
fi

- name: "check-dependencies (pre)"
Expand All @@ -68,101 +71,45 @@ jobs:
# not detected at release time by the upstream project.
# We run our "pre" check with `continue-on-error` set to true because it is equally possible that the upgrade
# _resolves_ the license / security issue we have had / would have had without the upgrade.
run: |
set -euo pipefail;
just check-dependencies
uses: &just "./.github/actions/just"
with:
recipe: "check-dependencies"
continue-on-error: true

- name: "cargo upgrade"
id: upgrade
- name: "cargo update"
id: "upgrade"
# sadly we can't use the just recipe here because this just command produces a github output
run: |
set -euo pipefail;
git config user.name "github-actions[bot]"
git config user.email "<224724778+hedgehog-dataplane-update[bot]@users.noreply.github.com>"
BASE="$(git rev-parse HEAD)"

# Run "cargo update"
echo "::notice::Running cargo update"
cargo update
if ! git diff --quiet; then
echo "Found changes after cargo update, creating commit"
git add Cargo.lock
git commit -sm "bump(cargo)!: bump dependencies (cargo update)"
fi

# Check updates available with "cargo upgrade",
# then bump each package individually through separate commits
echo "::notice::Looking for dependencies to upgrade"
cargo upgrade --incompatible=allow --dry-run | tee upgrade_output.txt
sed "/^====/d; /^name .*old req .*new req/d; s/ .*//" upgrade_output.txt > list_packages.txt
nb_upgrades=$(wc -l < list_packages.txt)

echo "Found the following ${nb_upgrades} upgrade(s) available:"
cat list_packages.txt

echo "::notice::Upgrading packages that need an upgrade (if any), one by one"
while read -r package; do
echo "bump(cargo)!: bump $package (cargo upgrade)" | tee commit_msg.txt
tee -a commit_msg.txt <<<""
cargo upgrade --incompatible=allow --package "$package" | tee -a commit_msg.txt
git add Cargo.lock Cargo.toml cli/Cargo.toml
git commit -sF commit_msg.txt
done < list_packages.txt

# If we did not create any commits, we do not need to create a PR message
if [[ "$(git rev-parse HEAD)" = "${BASE}" ]]; then
rm -f -- upgrade_output.txt list_packages.txt commit_msg.txt
exit 0
fi
echo "::notice::We created the following commits:"
git log --reverse -p "${BASE}"..

# Create Pull Request description
echo "### :rocket: Upgrades available" | tee upgrade.log
if [[ "${nb_upgrades}" -ge 1 ]]; then
echo "" | tee -a upgrade.log
echo "\`\`\`" | tee -a upgrade.log
tee -a upgrade.log < upgrade_output.txt
echo "\`\`\`" | tee -a upgrade.log
fi

tee -a upgrade.log <<<""
tee -a upgrade.log <<<":warning: This Pull Request was automatically generated and should be carefully reviewed before acceptance. It may introduce **breaking changes**."

cat upgrade.log > "${GITHUB_STEP_SUMMARY}"
{
echo "upgrade<<EOF";
cat upgrade.log;
echo "EOF";
} >> "${GITHUB_OUTPUT}"

rm -f -- upgrade.log upgrade_output.txt list_packages.txt commit_msg.txt
just bump-cargo-deps

- name: "check-dependencies (post)"
run: |
set -euo pipefail;
just check-dependencies
uses: *just
with:
recipe: "check-dependencies"

- name: "Create Pull Request"
uses: "peter-evans/create-pull-request@v8"
# zizmor: ignore[superfluous-actions] -- relies on this action's diff-detection,
# labeling, draft, and sign-commits behavior; not worth reimplementing over `gh pr create`.
uses: "peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1" # v8.1.1
with:
token: "${{ steps.app-token.outputs.token }}"
branch: "bump/cargo-upgrades"
title: "bump(cargo)!: :rocket: upgrades available"
title: "bump!: :rocket: upgrades available"
# ci:+cross/full opts the bump PR into the full cross matrix
# (build + qemu-user test on musl) to catch upstream regressions.
labels: |
automated
dependencies
ci:+cross/full
ci:+vlab
signoff: "true"
sign-commits: "true"
body: |
${{ steps.upgrade.outputs.upgrade }}

- name: "Setup tmate session for debug"
if: ${{ failure() && github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
uses: "mxschmitt/action-tmate@v3"
uses: "mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113" # v3.24
timeout-minutes: 60
with:
limit-access-to-actor: true
Loading
Loading