chore(ci): SPDX headers on line 1 and Actions lockfile minted - #307
Conversation
Two estate gates, one change. **SPDX.** `governance / Workflow security linter` checks `head -1 | grep`, so a workflow carrying its identifier below a managed-by comment reports as missing one. Each file's OWN identifier is moved to line 1 — nothing is imposed, because repositories here are variously MPL-2.0, PMPL-1.0-or-later and AGPL-3.0-or-later and a default would mis-declare the minority. Licences seen here: MPL-2.0. **Lockfile.** `gh actions-lock` resolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions — which is what OSSF Scorecard's Pinned-Dependencies check is asking for, and what an inline SHA cannot express. ⚠ Do NOT additionally SHA-pin inline. The mechanisms are mutually exclusive: `gh actions-lock` refuses a ref no tag or branch contains, so inline pinning REMOVES actions from the lockfile. Measured on hypatia 2026-08-07 — 40 inline pins caused 14 startup_failures and dropped 7 lockfile entries. Verified: all workflows parse, no duplicate identifiers, lockfile verify says "All 25 workflows have complete lockfile coverage.".
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
| @@ -1,3 +1,4 @@ | |||
| # This workflow is managed by gh actions-lock. | |||
🔍 Hypatia Security ScanFindings: 95 issues detected
View findings[
{
"reason": "Issue in build.yml",
"type": "missing_timeout_minutes",
"file": "build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in pages-deploy.yml",
"type": "missing_timeout_minutes",
"file": "pages-deploy.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in codeql.yml",
"type": "codeql_missing_actions_language",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "believe_me undermines formal verification (4 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafetyLemmas.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/nickel-validator.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "eval() -- arbitrary code execution (2 occurrences, CWE-94)",
"type": "js_eval",
"file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/security.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Deno -A grants all permissions -- use specific --allow-* flags (1 occurrences, CWE-250)",
"type": "js_deno_all_perms",
"file": "/home/runner/work/boj-server/boj-server/mcp-bridge/main.d.ts",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Zig @ptrCast performs unchecked pointer type conversion (1 occurrences, CWE-704)",
"type": "zig_ptr_cast",
"file": "/home/runner/work/boj-server/boj-server/ffi/zig/src/cartridge_shim.zig",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ Approved 3 resolved / 3 findingsUpdates CI workflows to add SPDX headers and mint an Actions lockfile, but pushes SPDX identifiers to line 2, replaces immutable SHA pins with mutable tags, and downgrades the rust-toolchain pin to a floating branch. ✅ 3 resolved✅ Bug: SPDX pushed to line 2, contradicting the PR's stated goal
✅ Security: SHA pins replaced with mutable tags; lockfile not enforced at runtime
✅ Security: rust-toolchain pinned SHA downgraded to floating @master branch
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
There was a problem hiding this comment.
Configure merge blocking · Maintainers can dismiss this review.
`gh actions-lock` inserts `# This workflow is managed by gh actions-lock.` at line 1, which displaced the SPDX identifier moved there earlier in this branch. The linter greps `head -1` only, so the header read as missing again. Each file's OWN identifier is moved back to line 1 — nothing imposed. Files already correct are untouched, and any file carrying two identifiers aborts the change rather than guessing.
🔍 Hypatia Security ScanFindings: 95 issues detected
View findings[
{
"reason": "Issue in build.yml",
"type": "missing_timeout_minutes",
"file": "build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in pages-deploy.yml",
"type": "missing_timeout_minutes",
"file": "pages-deploy.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in codeql.yml",
"type": "codeql_missing_actions_language",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "believe_me undermines formal verification (4 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafetyLemmas.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/nickel-validator.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "eval() -- arbitrary code execution (2 occurrences, CWE-94)",
"type": "js_eval",
"file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/security.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Deno -A grants all permissions -- use specific --allow-* flags (1 occurrences, CWE-250)",
"type": "js_deno_all_perms",
"file": "/home/runner/work/boj-server/boj-server/mcp-bridge/main.d.ts",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Zig @ptrCast performs unchecked pointer type conversion (1 occurrences, CWE-704)",
"type": "zig_ptr_cast",
"file": "/home/runner/work/boj-server/boj-server/ffi/zig/src/cartridge_shim.zig",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
🔍 Hypatia Security ScanFindings: 95 issues detected
View findings[
{
"reason": "Issue in build.yml",
"type": "missing_timeout_minutes",
"file": "build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in pages-deploy.yml",
"type": "missing_timeout_minutes",
"file": "pages-deploy.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in push-email-notify.yml",
"type": "missing_timeout_minutes",
"file": "push-email-notify.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in codeql.yml",
"type": "codeql_missing_actions_language",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "believe_me undermines formal verification (4 occurrences, CWE-704)",
"type": "believe_me",
"file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafetyLemmas.idr",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78)",
"type": "js_exec_sync",
"file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/nickel-validator.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "eval() -- arbitrary code execution (2 occurrences, CWE-94)",
"type": "js_eval",
"file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/security.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
},
{
"reason": "Deno -A grants all permissions -- use specific --allow-* flags (1 occurrences, CWE-250)",
"type": "js_deno_all_perms",
"file": "/home/runner/work/boj-server/boj-server/mcp-bridge/main.d.ts",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
},
{
"reason": "Zig @ptrCast performs unchecked pointer type conversion (1 occurrences, CWE-704)",
"type": "zig_ptr_cast",
"file": "/home/runner/work/boj-server/boj-server/ffi/zig/src/cartridge_shim.zig",
"action": "flag",
"rule_module": "code_safety",
"severity": "high"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
✅ All code review findings resolved.
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
2 participants
Two estate gates, one change.
SPDX — the linter checks
head -1only, so workflows carrying their identifier below a managed-by comment report as missing one. Each file's own identifier is moved to line 1; nothing is imposed (repos here are variously MPL-2.0, PMPL-1.0-or-later, AGPL-3.0-or-later). Licences in this repo:MPL-2.0.Lockfile (minted) —
gh actions-lockresolves each symbolic ref to a verified commit plus owner_id, repo_id and the transitive dependencies of composite actions. That is what Scorecard's Pinned-Dependencies check wants, and what an inline SHA cannot express.⚠ Do not additionally SHA-pin inline — the mechanisms are mutually exclusive, and inline pinning removes actions from the lockfile (measured on hypatia: 14
startup_failures).Verified: all workflows parse · no duplicate SPDX identifiers ·
gh actions-lock --verify-local: All 25 workflows have complete lockfile coverage.🤖 Generated with Claude Code