CI: add codeql-actions + secrets-audit scanner workflows - #26
Conversation
Byte-identical propagation from developer-meta-files consumer-templates. Closes scanner-coverage gaps (bandit already present): - consumer-codeql-actions.yml: CodeQL 'actions' language -- workflow-YAML security analysis (script-injection, missing permissions, unpinned actions). - consumer-secrets-audit.yml: manual-dispatch secrets surface audit (presence flags only, values never emitted). Managed files -- do not hand-edit; regenerated on the next propagation pass. ## AI-Assisted Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughAdded CodeQL Actions and secrets-surface audit workflows. Both wrappers use scoped permissions and concurrency cancellation. The CodeQL workflow supports pushes, pull requests, and manual dispatch. The secrets audit workflow supports manual dispatch and inherits repository and organization secrets. ChangesSecurity automation workflows
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/consumer-secrets-audit.yml (1)
17-21: 🔒 Security & Privacy | 🔵 TrivialLock workflow_dispatch to trusted maintainers.
secrets: inheritpasses all available secrets to the reusable workflow. The reusable implementation resolves only presence, but this wrapper still grants that context throughworkflow_dispatchon the latest@masterref. Require trusted maintainer dispatch before combiningsecrets: inheritwith a branch-controlled reusable workflow.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/consumer-secrets-audit.yml around lines 17 - 21, Restrict the workflow_dispatch entry point in the consumer secrets audit wrapper to trusted maintainers before invoking the reusable workflow with secrets: inherit. Update the dispatch permissions or authorization guard in the workflow so untrusted users cannot trigger the branch-controlled reusable workflow while preserving the existing audit invocation for approved maintainers.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/consumer-secrets-audit.yml:
- Line 40: Update the reusable workflow references in
.github/workflows/consumer-secrets-audit.yml:40-40 and
.github/workflows/consumer-codeql-actions.yml:43-43 to replace the mutable
master ref with reviewed, full-length commit SHAs, preserving each workflow’s
existing reusable workflow path.
---
Nitpick comments:
In @.github/workflows/consumer-secrets-audit.yml:
- Around line 17-21: Restrict the workflow_dispatch entry point in the consumer
secrets audit wrapper to trusted maintainers before invoking the reusable
workflow with secrets: inherit. Update the dispatch permissions or authorization
guard in the workflow so untrusted users cannot trigger the branch-controlled
reusable workflow while preserving the existing audit invocation for approved
maintainers.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bc04e00a-55a3-45df-b1a5-7decdb3fc1a5
📒 Files selected for processing (2)
.github/workflows/consumer-codeql-actions.yml.github/workflows/consumer-secrets-audit.yml
|
|
||
| jobs: | ||
| audit: | ||
| uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-secrets-audit.yml@master |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
files=(
.github/workflows/consumer-secrets-audit.yml
.github/workflows/consumer-codeql-actions.yml
)
if rg -nP '@(?:master|main|latest|v\d+(?:\.\d+)*)\s*(?:#.*)?$' "${files[@]}"; then
echo "Mutable workflow reference found" >&2
exit 1
fiRepository: org-ai-assisted/security-misc
Length of output: 488
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '--- workflow headers and relevant uses entries ---\n'
git ls-files .github/workflows | sed -n '1,120p'
printf '\n--- consumer-secrets-audit.yml relevant section ---\n'
cat -n .github/workflows/consumer-secrets-audit.yml | sed -n '1,80p'
printf '\n--- consumer-codeql-actions.yml relevant section ---\n'
cat -n .github/workflows/consumer-codeql-actions.yml | sed -n '1,90p'
printf '\n--- reusable action refs in workflows ---\n'
rg -n 'uses:\s*[^#]+@([^#\n]+)' .github/workflows .github/workflows/consumer-secrets-audit.yml .github/workflows/consumer-codeql-actions.yml || trueRepository: org-ai-assisted/security-misc
Length of output: 258
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow files ---'
git ls-files .github/workflows | sed -n '1,160p'
printf '%s\n' ''
printf '%s\n' '--- consumer-secrets-audit.yml relevant section ---'
cat -n .github/workflows/consumer-secrets-audit.yml | sed -n '1,90p'
printf '%s\n' ''
printf '%s\n' '--- consumer-codeql-actions.yml relevant section ---'
cat -n .github/workflows/consumer-codeql-actions.yml | sed -n '1,90p'
printf '%s\n' ''
printf '%s\n' '--- reusable workflow refs in workflows ---'
rg -n 'uses:\s*[^#]+@([^#\n]+)' .github/workflows || trueRepository: org-ai-assisted/security-misc
Length of output: 6061
Pin the reusable workflow references to reviewed commit SHAs.
Both consumer workflows call org-ai-assisted/developer-meta-files reusable workflows with the mutable master branch. Reusable workflows can run untrusted steps, and this changes the trusted content of the workflow itself. Pin both uses entries to reviewed full-length commit SHAs.
.github/workflows/consumer-secrets-audit.yml#L40-L40.github/workflows/consumer-codeql-actions.yml#L43-L43
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 40-40: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
📍 Affects 2 files
.github/workflows/consumer-secrets-audit.yml#L40-L40(this comment).github/workflows/consumer-codeql-actions.yml#L43-L43
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/consumer-secrets-audit.yml at line 40, Update the reusable
workflow references in .github/workflows/consumer-secrets-audit.yml:40-40 and
.github/workflows/consumer-codeql-actions.yml:43-43 to replace the mutable
master ref with reviewed, full-length commit SHAs, preserving each workflow’s
existing reusable workflow path.
2 participants
Closes scanner-coverage gaps by byte-identical propagation of consumer workflows from developer-meta-files consumer-templates. Each file verified byte-identical to the master template blob.
Managed files; regenerated on the next propagation pass.
Generated with assistance from Claude Code.
Summary by CodeRabbit