ci(security): add informational security checks - #2930
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
🌿 Preview your docs: https://nvidia-preview-pr-2930.docs.buildwithfern.com/openshell |
|
/ok to test 1a6053e |
1a6053e to
228bf5a
Compare
|
/ok to test 228bf5a |
Signed-off-by: Adrien Langou <alangou@nvidia.com>
228bf5a to
8e2b40d
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Cover maintained package ecosystems on a weekly cadence while grouping updates and limiting version-update PR churn. Signed-off-by: Adrien Langou <alangou@nvidia.com>
| patterns: | ||
| - "*" | ||
|
|
||
| - package-ecosystem: "cargo" |
There was a problem hiding this comment.
This looks like it expands what dependabot will scan, which is fine, but does it need to be part of this PR? It didn't seem to be called out directly but seems unrelated to the security checks. If it's not required here it would be nice to see it as its own PR to highlight that we're expanding dependabot's duties.
| github.event.workflow_run.conclusion == 'success' && | ||
| github.event.workflow_run.name == 'CodeQL' && | ||
| github.event.workflow_run.head_repository.full_name != github.repository && | ||
| github.event.workflow_run.pull_requests[0].number != null |
There was a problem hiding this comment.
https://github.com/orgs/community/discussions/25220
If this is still the case this report upload might not work
| if: >- | ||
| steps.analyze.outcome == 'success' && | ||
| (github.event_name != 'pull_request' || | ||
| github.event.pull_request.head.repo.full_name == github.repository) |
There was a problem hiding this comment.
[P2] Dependabot PRs are treated like fork PRs for GITHUB_TOKEN permissions, but their head repository still equals github.repository. This condition therefore runs upload-sarif with a read-only token, so the security-events: write upload will fail. Please exclude Dependabot here and route its retained SARIF through the trusted workflow_run uploader as another restricted-token context.
4 participants
Summary
Add observation-mode security checks for GitHub Actions, dependency changes, and the Rust/SDK codebase. Findings remain informational while scanner, configuration, and build failures stay visible.
Related Issue
Refs #2837
This PR implements the initial scanner-observation tranche and does not close the broader repository-hardening issue.
Changes
Testing
mise run pre-commitpassesmise run cipasses the existing suitemise run security:actionlintmise run security:zizmorChecklist