SonarCloud: GitHub Actions / dependency hardening (×13)

[don-petry]

GitHub Actions / dependency supply-chain hardening

SonarCloud open findings in petry-projects/.github — 13 issue(s) grouped as one workstream. Part of the org SonarCloud tuning initiative #593.

Findings

Rule	Count	Representative message
githubactions:S8541	5	Omitting "--only-binary :all:" can lead to the execution of setup scripts. Make sure it is
githubactions:S8544	3	Using dependencies without locking resolved versions is security-sensitive.
githubactions:S6505	2	"npx" can install packages on-demand and run their lifecycle scripts.
githubactions:S8545	2	Dependency versions are not predictable. Use a lock-file enforcing command instead.
githubactions:S8543	1	Define exact package version to avoid installing unverified releases.

Affected files

• .github/workflows/ci.yml (4)
• .github/workflows/feature-ideation-reusable.yml (2)
• .github/workflows/feature-ideation-tests.yml (2)
• .github/workflows/dependency-audit-reusable.yml (2)
• .github/workflows/dependency-audit.yml (2)
• .github/workflows/agent-shield-reusable.yml (1)

Approach

Harden workflow/package steps: pin exact versions, add --ignore-scripts/--only-binary, use lockfile-enforcing install commands. Where a step comes from a shared .github reusable, fix it at the source so callers inherit.

Acceptance

• All listed SonarCloud findings for this repo/workstream resolved to zero
• No behavior change; existing tests/CI green
• Fixes are real (no blanket NOSONAR unless a confirmed false positive, noted inline)

Filed from the 2026-07-03 org SonarCloud review.

[don-petry]

Dev-Lead Implementation Plan

Issue: #598 — SonarCloud: GitHub Actions / dependency hardening (×13)

Scope

Harden every flagged package-install step in the org workflows so pip installs
are hash-locked wheel-only exact-version installs and npx never installs
on-demand — resolving all 13 SonarCloud findings (S8541 ×5, S8544 ×3, S6505 ×2,
S8545 ×2, S8543 ×1) with no behavior change.

Approach

Follow the pattern already established in this repo by copilot-setup-steps.yml

• scripts/copilot-requirements.txt: pip install --require-hashes --only-binary :all: -r <hash-pinned-requirements>. This single pattern resolves
  S8541 (--only-binary), S8543 (exact version), S8544 + S8545 (lock/hash
  enforcement) together. For npx (S6505): install the pinned package with
  --ignore-scripts, then run via npx --no-install.

Implementation Checklist

• scripts/yamllint-requirements.txt — new, hash-pinned (yamllint==1.37.1)
• scripts/pip-audit-requirements.txt — new, hash-pinned (pip-audit==2.9.0)
• .github/workflows/ci.yml — yamllint pip install → hash-pinned; npx ecc-agentshield → install --ignore-scripts + npx --no-install
• .github/workflows/feature-ideation-reusable.yml — jsonschema install → hash-pinned (reuse scripts/copilot-requirements.txt from checked-out tooling)
• .github/workflows/feature-ideation-tests.yml — jsonschema install → hash-pinned (reuse scripts/copilot-requirements.txt)
• .github/workflows/dependency-audit-reusable.yml — pip-audit install → hash-pinned
• .github/workflows/dependency-audit.yml — pip-audit install → hash-pinned
• .github/workflows/agent-shield-reusable.yml — npx ecc-agentshield@<ver> → install --ignore-scripts + npx --no-install

Tests to Write

This is a behavior-preserving CI-configuration hardening change (dev-lead Phase 2
TDD exception). Validation instead of unit tests:

• Each new requirements file installs cleanly under pip install --require-hashes --only-binary :all: in a fresh venv (already validated locally)
• Existing feature-ideation bats suite stays green (bats test/workflows/feature-ideation/)
• actionlint + yamllint clean on all changed workflows
• bash .dev-lead/scripts/dev-lead-lint.sh passes

Test Command

bats test/workflows/feature-ideation/ && bash .dev-lead/scripts/dev-lead-lint.sh

[don-petry]

Dev-Lead: issue #598 implementation failed — will retry

The engine failed (engine-error — e.g. a timeout or transient engine error). This was attempt 1 of 3; dev-lead will retry automatically. You can also re-apply the dev-lead label to retry now.

• Cause: engine-error
• Run: https://github.com/petry-projects/.github/actions/runs/28684105088

[don-petry]

Dev-Lead: issue #598 implementation failed — will retry

The engine failed (engine-error — e.g. a timeout or transient engine error). This was attempt 2 of 3; dev-lead will retry automatically. You can also re-apply the dev-lead label to retry now.

• Cause: engine-error
• Run: https://github.com/petry-projects/.github/actions/runs/28687481353

Last 40 lines of engine output (redacted)

    [copilot] calling gh copilot (model=openai/o4-mini, timeout=600s, flags=--yolo)
Error: Classic Personal Access Tokens (ghp_) are not supported by Copilot.

The GH_TOKEN environment variable contains a classic PAT.
Please use a Fine-Grained Personal Access Token or another authentication method.

To fix this, you can:
  • Replace the token in GH_TOKEN with a fine-grained PAT
  • Unset GH_TOKEN and run 'gh auth login' to authenticate
  • Unset GH_TOKEN and start 'copilot', then use the '/login' command

[don-petry]

Dev-Lead Implementation Plan

Issue: #598 — SonarCloud: GitHub Actions / dependency hardening (×13)

Scope

Harden the install/package steps in 6 workflow files so all 13 SonarCloud supply-chain findings (S8541 ×5, S8544 ×3, S6505 ×2, S8545 ×2, S8543 ×1) resolve to zero, with no behavior change.

Finding → fix mapping

Derived by cross-referencing per-rule counts against the actual install commands:

Rule	Where	Fix
S8541 ×5	every pip install (ci, feature-ideation-reusable, feature-ideation-tests, dependency-audit-reusable, dependency-audit)	add --only-binary :all:
S8544 ×3	unpinned yamllint, jsonschema>=4 ×2	pin exact == (proven sufficient: pip-audit==2.9.0 gets only an S8541 finding, never S8544)
S8543 ×1	ci.yml npx ecc-agentshield (no version)	pin exact version
S6505 ×2	both npx ecc-agentshield calls (ci.yml, agent-shield-reusable.yml)	replace with npm install -g <pkg>@<ver> --ignore-scripts + run the installed binary
S8545 ×2	both go install …/govulncheck@v1.1.4	keep the checksum-DB-verified exact pin + narrow inline # NOSONAR(githubactions:S8545) — Go has no lock-file-enforcing command for tool@version installs (confirmed false positive, noted inline per the repo's existing S7637 marker convention)

Implementation Checklist

• .github/workflows/ci.yml — yamllint==1.35.1 --only-binary :all:; pinned npm install -g ecc-agentshield@1.4.0 --ignore-scripts + run binary
• .github/workflows/feature-ideation-reusable.yml — jsonschema==4.23.0 --only-binary :all:
• .github/workflows/feature-ideation-tests.yml — jsonschema==4.23.0 --only-binary :all:
• .github/workflows/dependency-audit-reusable.yml — --only-binary :all: on pip-audit; inline NOSONAR on go install
• .github/workflows/dependency-audit.yml — --only-binary :all: on pip-audit; inline NOSONAR on go install
• .github/workflows/agent-shield-reusable.yml — npm install -g "ecc-agentshield@${AS_VERSION}" --ignore-scripts + run binary

Tests to Write

• Phase-2 TDD exception invoked: these are behavior-preserving CI/config hardening changes to workflow YAML (no script logic changed, no observable behavior change). No new unit tests; instead the full existing suite + linters must stay green as a regression guard.
• Verified out-of-band that yamllint==1.35.1, jsonschema==4.23.0, pip-audit==2.9.0 all resolve fully under --only-binary :all: (all transitive deps ship wheels).

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh + bats test/ + actionlint/yamllint on changed workflows

[don-petry]

Dev-Lead: cannot implement issue #598 — needs human attention

Automatic retries are exhausted (attempt 3 of 3). The most recent failure was engine-error.

• Run: https://github.com/petry-projects/.github/actions/runs/28694269681

Please review the failures above. To retry anyway, remove the dev-lead:needs-human label and re-apply the dev-lead label.