Conversation
Closes #1. Four mitigations from the AST02 issue: 1. Grammar pinning + CI gate. The smacker/go-tree-sitter module is already pseudo-version-pinned to commit dd81d9e9be82, which transitively pins all three grammar bindings (golang, javascript, typescript). New 'go mod verify (pin gate)' step in ci.yml runs go mod verify and refuses 'replace' directives in go.mod so any future PR that loosens the pin fails CI. 2. govulncheck. New vuln job in ci.yml runs govulncheck against the Go vulnerability DB. Pinned to golang.org/x/vuln/cmd/govulncheck@v1.1.4 (immutable module tag). 3. SLSA re-verify at release. New 'verify SLSA attestations' step in the release job loops over every published tarball and runs 'gh attestation verify' against GitHub's attestation store. Fails the release on mismatch — catches an attacker who replaces the attestation between build and publish. 4. Trust-chain documentation. New docs/security.md covers the four trust boundaries (grammar / release / install hook / LSP subprocess) with explicit 'what it defends against' and 'what it does NOT defend against' sections per boundary, plus an at-a-glance summary table. All shell snippets use env: for ${{ }} interpolations; no untrusted input is interpolated in run: blocks (per OWASP Actions-injection guidance). Verified locally: go vet clean, go test ./... OK, smoke build OK.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1.
Four mitigations from the OWASP Agentic Skills Top 10 AST02 entry:
1. Grammar pinning + CI gate
The
smacker/go-tree-sittermodule is already pseudo-version-pinned to commitdd81d9e9be82, which transitively pins all three grammar bindings (golang,javascript,typescript/typescript). A newgo mod verify (pin gate)step inci.ymlrunsgo mod verifyand refusesreplacedirectives ingo.modso any future PR that loosens the pin fails CI.2. govulncheck
New
vulnjob inci.ymlrunsgovulncheck ./...against the Go vulnerability DB. Pinned togolang.org/x/vuln/cmd/govulncheck@v1.1.4(immutable module tag, not a SHA — Go module tags cannot be moved once published).3. SLSA re-verify at release
New
verify SLSA attestationsstep in thereleasejob loops over every published tarball and runsgh attestation verify --repo kellenff/yacttagainst GitHub's attestation store. Fails the release on mismatch — catches an attacker who replaces the attestation between build and publish.4. Trust-chain documentation
New
docs/security.mdcovers the four trust boundaries (grammar / release / install hook / LSP subprocess) with explicit "what it defends against" and "what it does NOT defend against" sections per boundary, plus an at-a-glance summary table.Security note on this PR's own workflow changes
Every new
run:snippet usesenv:for any${{ }}interpolation. Thefor tarball in *.tar.gzloop iterates locally-produced artifact names only; no untrusted input is interpolated in arun:block. This follows the OWASP GitHub-Actions-injection guidance flagged on every workflow edit.Verification
go vet ./...— cleango test ./...— all 12 packages pass (cache, contract, domain, id, lsp, mcp, parser, persisted, search, source, store, summarizer, tool, acceptance)go build -trimpath ./cmd/yactt— smoke build OKci.ymlandrelease.ymlparse as valid YAMLFiles
.github/workflows/ci.yml— +43 lines (pin gate + vuln job).github/workflows/release.yml— +23 lines (attestation verify step)docs/security.md— new, 153 lines