Harden and speed up CI workflows - #43
Merged
Merged
Conversation
Lock down the release job's egress and remove a shell-injection sink, then cut wasted work from the security and CI pipelines. Security: - pulumi-setup: pass cloud-url via an env var instead of interpolating it into the run script, closing a command-injection sink. - release-reusable: run harden-runner in block mode with disable-sudo and an allowlist scoped to the endpoints the publish path needs. This is the job that holds the GitHub App key and mints the npm OIDC credential, so egress should be deny-by-default. Speed: - ci: forward TURBO_TOKEN/TURBO_TEAM to the static-analysis workflow so Turbo remote caching can actually take effect (inert until the secrets are added). - security-analysis: drop CodeQL Autobuild and set build-mode none; JS/TS needs no compilation step. - security: skip the suite on docs-only changes via paths-ignore. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
kin0992
added a commit
that referenced
this pull request
Jun 3, 2026
## Why After the egress block landed in #43, the release workflow started failing in `kin0992/f1` — two hosts were missing from the allowlist, and Next.js telemetry was making an unconfigured outbound call. ## What - Add `release-assets.githubusercontent.com:443` — needed to download toolchain release assets during setup/build. - Add `fonts.googleapis.com:443` — fetched by Next.js at build time when the app uses `next/font` with Google Fonts. - Set `NEXT_TELEMETRY_DISABLED=1` on the Build step — suppresses the telemetry call at source rather than allowlisting `telemetry.nextjs.org`. ## How to verify Re-run the failing job at https://github.com/kin0992/f1/actions/runs/26915760107 after this merges. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The release job carries the most sensitive credentials in the repo (GitHub App private key + npm OIDC publish token) but ran with audit-only egress, and
pulumi-setupinterpolated an input into a shell command. Separately, CI was leaving easy performance on the table — Turbo remote-cache creds were never forwarded, CodeQL ran a pointless build step, and the security suite re-ran on docs-only changes.What
Security
pulumi-setup: passcloud-urlvia an env var instead of${{ }}interpolation inrun:, closing a command-injection sink.release-reusable: harden-runner now runsegress-policy: block+disable-sudo: truewith an allowlist scoped to exactly what the publish path needs (GitHub, npm registry, Node download, sigstore).Speed
ci: forwardTURBO_TOKEN/TURBO_TEAMto the static-analysis workflow (explicitly, notsecrets: inherit, so fork PRs stay cache-read-only). Inert until the secrets are added to the repo.security-analysis: drop CodeQL Autobuild, setbuild-mode: none— JS/TS needs no compilation.security:paths-ignoredocs (**/*.md,LICENSE,.editorconfig).How to verify
Static Analysis (self)(the required check) passes on this PR.Risks / follow-ups
TURBO_TOKEN/TURBO_TEAMare created and added to repo secrets.@mainaction refs, andenforceAdmins: trueon branch protection.