ci(workflows): presence-gate mirror SSH steps + correct registry-verify licence#367
Merged
Conversation
…fy licence - mirror-reusable.yml: gate each forge's webfactory/ssh-agent step AND its push step on secrets.<FORGE>_SSH_KEY != '' (matching the existing Radicle pattern). Resolves Hypatia secret_action_without_presence_gate (high) and makes an enabled-but-keyless mirror a clean no-op rather than a hard failure. - registry-verify.yml: SPDX AGPL-3.0-or-later -> MPL-2.0 (owner-directed; aligns with its 27 sibling workflows; clears Hypatia agpl_license). Note: scorecard_publish_with_run_step on scorecard-enforcer.yml is a Hypatia false positive — the publish job is already uses-only with the threshold check split into a downstream check-score job. https://claude.ai/code/session_01AmPXB2dA2wCcabo8BXwS28
🔍 Hypatia Security ScanFindings: 141 issues detected
View findings[
{
"reason": "Action for the check script)\n uses: actions/checkout@de0f needs attention",
"type": "unpinned_action",
"file": "governance-reusable.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action for the check script)\n uses: actions/checkout@de0f needs attention",
"type": "unpinned_action",
"file": "governance-reusable.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in governance.yml",
"type": "missing_timeout_minutes",
"file": "governance.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in mirror.yml",
"type": "missing_timeout_minutes",
"file": "mirror.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard.yml",
"type": "missing_timeout_minutes",
"file": "scorecard.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in secret-scanner.yml",
"type": "missing_timeout_minutes",
"file": "secret-scanner.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "scorecard_publish_with_run_step",
"file": "scorecard-enforcer.yml",
"action": "split_scorecard_publish_job",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Python file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
🔍 Hypatia Security ScanFindings: 141 issues detected
View findings[
{
"reason": "Action for the check script)\n uses: actions/checkout@de0f needs attention",
"type": "unpinned_action",
"file": "governance-reusable.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Action for the check script)\n uses: actions/checkout@de0f needs attention",
"type": "unpinned_action",
"file": "governance-reusable.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in governance.yml",
"type": "missing_timeout_minutes",
"file": "governance.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in mirror.yml",
"type": "missing_timeout_minutes",
"file": "mirror.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard.yml",
"type": "missing_timeout_minutes",
"file": "scorecard.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in secret-scanner.yml",
"type": "missing_timeout_minutes",
"file": "secret-scanner.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard-enforcer.yml",
"type": "scorecard_publish_with_run_step",
"file": "scorecard-enforcer.yml",
"action": "split_scorecard_publish_job",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in instant-sync.yml",
"type": "secret_action_without_presence_gate",
"file": "instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Python file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
},
{
"reason": "TypeScript file detected -- banned language",
"type": "banned_language_file",
"file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
"action": "flag",
"rule_module": "cicd_rules",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two workflow-hardening / hygiene fixes flagged by the Hypatia scan.
1.
mirror-reusable.yml— presence-gate the SSH secret (Hypatiasecret_action_without_presence_gate, high)Each forge job (GitLab, Bitbucket, Codeberg, SourceHut, Disroot, Gitea) ran
webfactory/ssh-agentgated only onvars.<FORGE>_MIRROR_ENABLED, so an enabled-but-keyless mirror would feed an empty key to the action and fail. Addedif: ${{ secrets.<FORGE>_SSH_KEY != '' }}to both thessh-agentstep and its push step in all 6 jobs — matching the existing Radicle pattern in the same file. Now a mirror with no configured key is a clean no-op instead of a hard failure.2.
registry-verify.yml— licence correction (owner-directed)SPDX
AGPL-3.0-or-later→MPL-2.0. It was the only one of 28 workflows on AGPL; this aligns it with its siblings and the repo's sole-owner MPL-2.0 classification, and clears Hypatia'sagpl_licensefinding.Not changed (Hypatia false positives, documented)
scorecard_publish_with_run_steponscorecard-enforcer.yml— the publish job (scorecard) is already uses-only, with the threshold check split into a downstreamcheck-scorejob (there's a comment documenting exactly this). Hypatia flagsrun:steps elsewhere in the file without scoping to the job.unpinned_action— everyuses:is SHA-pinned; Hypatia truncates the SHA and mis-flags. (Foundational fix tracked for the Hypatia repo.)Verification
Flagged, not swept
Other
AGPL-3.0-or-laterSPDX headers remain inscripts/*.shand.github/FUNDING.yml. Per the manual-only / no-bulk-SPDX guardrail I did not sweep them — surfacing for an explicit decision on whether they should also go to MPL-2.0.https://claude.ai/code/session_01AmPXB2dA2wCcabo8BXwS28
Generated by Claude Code