Harden workflows and activate Copilot guidance by chrismaz11 · Pull Request #111 · TrustSignal-dev/TrustSignal

chrismaz11 · 2026-04-09T17:17:32Z

Summary

remove the redundant ai-skill-sync.yml workflow and consolidate AI-control sync into sync.yml
pin GitHub Actions revisions across CI, CodeQL, Copilot setup, Scorecard, and artifact verification workflows
add explicit top-level read-only permissions where missing
move artifact verification off every push and onto workflow_dispatch plus published releases
make copilotsetupsteps.yml intentional for GitHub agents and add .github/copilot-instructions.md
add missing install/bootstrap steps for the local verify-artifact action checks

Why

This reduces workflow-related Security tab noise, tightens token scope, makes the GitHub agent surface usable, and removes overlapping automation that was not adding value.

Expected follow-up

workflow/code-scanning alert counts should drop after GitHub re-runs CodeQL and rescans the workflow set
remaining open security findings should mostly be app-level code scanning plus a small number of dependency alerts

vercel · 2026-04-09T17:17:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
trustsignal	Ready	Preview, Comment	Apr 10, 2026 5:32pm

apps/api/src/security.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 252537429d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

.github/workflows/ci.yml

Copilot

Pull request overview

This PR primarily hardens GitHub Actions workflows (pinning actions, narrowing permissions, consolidating AI control sync, and adjusting artifact verification triggers) and adds repo-level Copilot guidance, while also introducing API-side rate limiting refactors plus dependency/lockfile updates.

Changes:

Consolidates AI control/skill sync into sync.yml, removes the redundant workflow, and adds .github/copilot-instructions.md.
Pins GitHub Actions to commit SHAs, adds explicit read-only permissions, and moves artifact verification to workflow_dispatch + release.published.
Updates API code for rate limiting/auth hashing behavior and refreshes multiple dependency lockfiles.

Reviewed changes

Copilot reviewed 12 out of 15 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`vantademo/package-lock.json`	Bumps `picomatch` patch version in demo lockfile.
`src/routes/verify.ts`	Adds per-route rate limiting to `/v1/verify-bundle`.
`sdk/index.ts`	Replaces regex URL trimming with a helper function.
`package-lock.json`	Updates lockfile (notably `serialize-javascript`).
`apps/api/src/server.ts`	Refactors some routes to combine scope + per-key rate limiting via a helper.
`apps/api/src/security.ts`	Switches API key hashing to WebCrypto and updates rate-limit fingerprinting.
`apps/api/package-lock.json`	Large dependency/lockfile update (adds Solana web3, bumps Fastify/pdf libs, etc.).
`.github/workflows/sync.yml`	Renames/retools AI control sync workflow; pins checkout/setup-node; adds inputs and summary.
`.github/workflows/scorecard.yml`	Pins actions and trims workflow boilerplate; pins CodeQL SARIF upload action.
`.github/workflows/main.yml`	Runs artifact verification only on dispatch + published releases; pins checkout.
`.github/workflows/copilotsetupsteps.yml`	Pins actions, uses Node 20, adds `npm ci` and Prisma generate step.
`.github/workflows/codeql.yml`	Pins CodeQL actions and adds top-level read-only permissions.
`.github/workflows/ci.yml`	Pins actions, adds read-only permissions, and installs deps for local verify-artifact action checks.
`.github/workflows/ai-skill-sync.yml`	Removes the redundant legacy AI skill sync workflow.
`.github/copilot-instructions.md`	Adds Copilot guidance (commands, scope, risk areas, workflow conventions).

Files not reviewed (2)

apps/api/package-lock.json: Language not supported
vantademo/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

apps/api/src/server.ts

apps/api/package-lock.json

src/routes/verify.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 33eab74e40

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/api/src/server.ts

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 395c563557

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/api/src/security.ts

Copilot

Pull request overview

Copilot reviewed 13 out of 17 changed files in this pull request and generated 3 comments.

Files not reviewed (3)

apps/api/package-lock.json: Language not supported
github-actions/trustsignal-verify-artifact/package-lock.json: Language not supported
vantademo/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

apps/api/src/security.ts

apps/api/src/server.ts

src/routes/verify.ts

Copilot

Pull request overview

Copilot reviewed 13 out of 17 changed files in this pull request and generated 3 comments.

Files not reviewed (3)

apps/api/package-lock.json: Language not supported
github-actions/trustsignal-verify-artifact/package-lock.json: Language not supported
vantademo/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

apps/api/src/security.ts

apps/api/package-lock.json

chrismaz11

@copilot

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

chrismaz11 · 2026-04-10T15:31:24Z

@copilot apply changes based on the comments in this thread

…ype import Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/e10f7335-a7c1-4a92-820b-6c76ffd0fb62 Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

…tion plan Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/e10f7335-a7c1-4a92-820b-6c76ffd0fb62 Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

Copilot · 2026-04-10T15:33:38Z

@copilot

Addressed the outstanding review feedback in commits f050ec4 and b347eca:

apps/api/src/security.ts — Reverted hashApiKey from scrypt back to SHA-256. Per DECISIONS.md, public.api_keys.key_hash is defined as SHA-256; swapping to scrypt (with a constant salt) would have broken auth for all existing production API keys. Also restored fingerprintApiKey to derive from hashApiKey and removed the now-unused API_KEY_HASH_SALT constant and scryptSync/createHmac imports.
apps/api/src/server.ts — Removed status: 'REVOKED' from the revoke endpoint response. The OpenAPI RevocationResponse schema has additionalProperties: false and doesn't declare status, so strict clients would have rejected the response.
src/routes/verify.ts — The side-effect import '@fastify/rate-limit' was already absent in the latest commit; no further change needed.
DECISIONS.md — Added a note explaining that SHA-256 is intentional for high-entropy API key tokens (not low-entropy passwords), and that migrating to a per-key-salt KDF requires a backwards-compatible dual-hash strategy plus an explicit schema migration — tracked separately.

The CodeQL js/insufficient-password-hash alert remains open as a known accepted risk per the updated DECISIONS.md rationale. All 72 tests pass and npm run typecheck is clean.

chrismaz11 · 2026-04-10T15:37:09Z

@copilot apply changes based on the comments in this thread

Copilot

Pull request overview

Copilot reviewed 13 out of 18 changed files in this pull request and generated 1 comment.

Files not reviewed (3)

apps/api/package-lock.json: Language not supported
github-actions/trustsignal-verify-artifact/package-lock.json: Language not supported
vantademo/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

apps/api/package-lock.json

Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/6ae3c972-c937-4278-adee-6c9c870e64f4 Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

Copilot · 2026-04-10T15:44:18Z

@copilot apply changes based on the comments in this thread

All three comments in that review were already addressed in previous commits (f050ec4, b347eca, c168392) — SHA-256 restored, status: 'REVOKED' removed, and the side-effect import was already absent.

@copilot apply changes based on the comments in this thread

Applied in commit 1f8cd33:

scopedRateLimit removed entirely — all 11 routes now use config: { rateLimit: perApiKeyRateLimit } (applied by the plugin at onRequest, before body parsing) with preHandler: [requireScope(scope)] for auth, consistent with all other rate-limited routes.
Node version — package.json engines.node tightened to ">=20.18.0 <21"; node-version updated to '20.18' in ci.yml, copilotsetupsteps.yml, and sync.yml.

Copilot

Pull request overview

Copilot reviewed 13 out of 18 changed files in this pull request and generated 3 comments.

Files not reviewed (3)

apps/api/package-lock.json: Language not supported
github-actions/trustsignal-verify-artifact/package-lock.json: Language not supported
vantademo/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/workflows/scorecard.yml

Copilot · 2026-04-10T15:49:47Z

.github/workflows/ci.yml

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.0.0
        with:
-          node-version: 22
+          node-version: '22'
+
+      - name: Install action dependencies
+        working-directory: github-actions/trustsignal-verify-artifact
+        run: npm ci


This job uses Node.js 22, but the repo declares support as >=20.18.0 <21 (root package.json engines). Even if this subdirectory install works, running CI on a newer major can hide compatibility issues; consider aligning this to 20.18 (or explain why Node 22 is required for the action checks).

@copilot apply changes based on this feedback

Copilot · 2026-04-10T15:49:47Z

package.json

  "engines": {
-    "node": "20.x"
+    "node": ">=20.18.0 <21"
  },
  "workspaces": [
    "apps/*",
    "packages/*"
  ],
  "dependencies": {
-    "axios": "^1.13.6",
+    "axios": "^1.15.0",
    "better-sqlite3": "^12.8.0",


The PR description is focused on workflow hardening/Copilot guidance, but this change also updates runtime/runtime-adjacent dependency constraints (e.g. Node engine range and axios bump). To keep review/auditability tight, either call out these dependency/runtime changes explicitly in the PR description or split them into a separate PR.

@copilot apply changes based on this feedback

Updated the PR description (ab151fe) to explicitly call out all dependency/runtime changes: Node engine range tightened to >=20.18.0 <21, all CI jobs pinned to 20.18, and the scopedRateLimit/auth hashing behavior changes. Also took the opportunity to align the verify-artifact CI job from Node 22 to 20.18 to match the repo engines constraint.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

chrismaz11 · 2026-04-10T17:31:03Z

@copilot apply changes based on the comments in this thread

Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/a2817e71-139d-4e5a-8225-df6d98d3802a Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

Harden workflows and activate Copilot guidance

e45edb6

vercel bot deployed to Preview – trustsignal April 9, 2026 17:18 View deployment

Fix remaining dependency and code scan alerts

2525374

chrismaz11 marked this pull request as ready for review April 9, 2026 18:19

Copilot AI review requested due to automatic review settings April 9, 2026 18:19

vercel bot deployed to Preview – trustsignal April 9, 2026 18:19 View deployment

github-advanced-security bot found potential problems Apr 9, 2026

View reviewed changes

apps/api/src/security.ts Fixed Show fixed Hide fixed

Copilot started reviewing on behalf of chrismaz11 April 9, 2026 18:20 View session

chatgpt-codex-connector bot reviewed Apr 9, 2026

View reviewed changes

.github/workflows/ci.yml Show resolved Hide resolved

Copilot AI reviewed Apr 9, 2026

View reviewed changes

apps/api/src/server.ts Outdated Show resolved Hide resolved

apps/api/package-lock.json Show resolved Hide resolved

src/routes/verify.ts Outdated Show resolved Hide resolved

Fix PR CI regressions

33eab74

vercel bot deployed to Preview – trustsignal April 10, 2026 06:09 View deployment

chatgpt-codex-connector bot reviewed Apr 10, 2026

View reviewed changes

apps/api/src/server.ts Outdated Show resolved Hide resolved

Resolve remaining CodeQL alerts

395c563

vercel bot deployed to Preview – trustsignal April 10, 2026 07:18 View deployment

chatgpt-codex-connector bot reviewed Apr 10, 2026

View reviewed changes

apps/api/src/security.ts Outdated Show resolved Hide resolved

chrismaz11 requested a review from Copilot April 10, 2026 14:50

Copilot started reviewing on behalf of chrismaz11 April 10, 2026 14:51 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

apps/api/src/security.ts Outdated Show resolved Hide resolved

apps/api/src/server.ts Outdated Show resolved Hide resolved

src/routes/verify.ts Outdated Show resolved Hide resolved

chrismaz11 requested a review from Copilot April 10, 2026 15:05

Copilot started reviewing on behalf of chrismaz11 April 10, 2026 15:06 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

apps/api/src/security.ts Outdated Show resolved Hide resolved

apps/api/src/security.ts Outdated Show resolved Hide resolved

apps/api/package-lock.json Show resolved Hide resolved

chrismaz11 commented Apr 10, 2026

View reviewed changes

Copilot started work on behalf of chrismaz11 April 10, 2026 15:28 View session

Update src/routes/verify.ts

c168392

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

vercel bot deployed to Preview – trustsignal April 10, 2026 15:29 View deployment

Fix: revert hashApiKey to SHA-256, remove invalid status field, fix t…

f050ec4

…ype import Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/e10f7335-a7c1-4a92-820b-6c76ffd0fb62 Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

chrismaz11 requested a review from Copilot April 10, 2026 15:32

vercel bot deployed to Preview – trustsignal April 10, 2026 15:32 View deployment

Copilot started reviewing on behalf of chrismaz11 April 10, 2026 15:33 View session

docs: document SHA-256 API key hashing rationale and future KDF migra…

b347eca

…tion plan Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/e10f7335-a7c1-4a92-820b-6c76ffd0fb62 Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

vercel bot deployed to Preview – trustsignal April 10, 2026 15:34 View deployment

Copilot finished work on behalf of chrismaz11 April 10, 2026 15:35

Copilot started work on behalf of chrismaz11 April 10, 2026 15:37 View session

Copilot AI reviewed Apr 10, 2026

View reviewed changes

apps/api/package-lock.json Show resolved Hide resolved

fix: move rate limit to route config, tighten Node version to >=20.18.0

1f8cd33

Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/6ae3c972-c937-4278-adee-6c9c870e64f4 Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

vercel bot deployed to Preview – trustsignal April 10, 2026 15:43 View deployment

chrismaz11 requested a review from Copilot April 10, 2026 15:44

Copilot started reviewing on behalf of chrismaz11 April 10, 2026 15:45 View session

Copilot finished work on behalf of chrismaz11 April 10, 2026 15:45

Copilot AI reviewed Apr 10, 2026

View reviewed changes

Copilot started work on behalf of chrismaz11 April 10, 2026 17:30 View session

Update .github/workflows/scorecard.yml

3b064dd

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

vercel bot deployed to Preview – trustsignal April 10, 2026 17:31 View deployment

fix: align verify-artifact CI job to Node 20.18, update PR description

ab151fe

Agent-Logs-Url: https://github.com/TrustSignal-dev/TrustSignal/sessions/a2817e71-139d-4e5a-8225-df6d98d3802a Co-authored-by: chrismaz11 <24700273+chrismaz11@users.noreply.github.com>

vercel bot deployed to Preview – trustsignal April 10, 2026 17:32 View deployment

Copilot finished work on behalf of chrismaz11 April 10, 2026 17:34

Conversation

chrismaz11 commented Apr 9, 2026

Summary

Why

Expected follow-up

Uh oh!

vercel bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chrismaz11 left a comment

Choose a reason for hiding this comment

Uh oh!

chrismaz11 commented Apr 10, 2026

Uh oh!

Copilot AI commented Apr 10, 2026

Uh oh!

chrismaz11 commented Apr 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

chrismaz11 Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

chrismaz11 Apr 10, 2026

Choose a reason for hiding this comment

vercel bot commented Apr 9, 2026 •

edited

Loading

Copilot AI commented Apr 10, 2026 •

edited

Loading