Skip to content

ci(spellcheck): pin misspell + add least-privilege permissions#1450

Open
bmehta001 wants to merge 1 commit into
microsoft:mainfrom
bmehta001:bhamehta/spellcheck-hardening
Open

ci(spellcheck): pin misspell + add least-privilege permissions#1450
bmehta001 wants to merge 1 commit into
microsoft:mainfrom
bmehta001:bhamehta/spellcheck-hardening

Conversation

@bmehta001
Copy link
Copy Markdown
Contributor

Summary

Hardens .github/workflows/spellcheck.yml with the same three fixes already landed in the sister modules repo (microsoft/cpp_client_telemetry_modules#320, commits f596201 + 7540eec + 8d26e48):

  1. Least-privilege GITHUB_TOKEN — adds a top-level permissions: { contents: read } block. Without it, the workflow inherits the repo default (read+write on most APIs); misspell only needs to walk .md/.txt/lib/tests files. Also forward-compatible with enabling actions analysis in codeql-analysis.yml later (it would immediately flag actions/missing-workflow-permissions otherwise — that rule is what surfaced the same issue on the modules side).
  2. Pin misspell to v0.3.4 release tarball — replaces the unpinned curl https://git.io/misspell | sh bootstrap (executes a shell script from master of an external repo via a redirect — supply-chain risk + non-reproducible) with a direct download of a specific release artifact from GitHub releases.
  3. SHA256 verify the tarball against the upstream-published afd95caf1eecc72ff382791e00b3b11523a20b0579d95e2295c1c043688743d5 (linux_64bit). Any tampering or unexpected upstream change fails CI rather than silently executing.

Scope of misspell unchanged: still scans .md, .txt, examples/**, all of lib/ (excluding json.hpp), and tests/**. The fix is purely the install + permissions layer.

Why now

GHAS in this repo doesn't currently scan workflow files (the codeql-analysis.yml matrix is [cpp, javascript, python] + java — no actions language), so this gap wasn't surfaced as a security alert. The audit on modules revealed it by analogy; small enough to fix proactively.

Validation

The misspell workflow will run on this PR automatically (push trigger). On the modules-side equivalent commit, the same workflow passed first try.

Bump procedure (for posterity)

To bump misspell: download the new tarball + checksum from https://github.com/client9/misspell/releases, update MISSPELL_VERSION and MISSPELL_SHA256 in this workflow.

Three hardening fixes for .github/workflows/spellcheck.yml, ported
from the same audit applied to the sister modules repo:

1. Add top-level 'permissions: contents: read'. Without an explicit
   block, the GITHUB_TOKEN inherits the repo default (typically
   read+write across most APIs), which is far more than misspell
   needs. misspell only walks .md/.txt/lib/tests files and prints
   typos to stdout; it never comments on PRs, posts statuses, or
   writes packages. This also satisfies CodeQL rule
   'actions/missing-workflow-permissions' if Actions analysis is
   enabled here later (it isn't in the current codeql-analysis.yml
   matrix, but no reason to wait for that).

2. Replace the unpinned bootstrap install with a pinned tarball
   download. The prior 'curl https://git.io/misspell | sh' pattern
   executed a shell script from the master branch of an external
   repo via a git.io redirect — a supply-chain risk that also made
   CI non-reproducible. Now we download a specific release artifact
   (v0.3.4) directly from GitHub releases.

3. Verify the tarball SHA256 against the published checksum
   'afd95caf1eecc72ff382791e00b3b11523a20b0579d95e2295c1c043688743d5'
   (linux_64bit). Any tampering or unexpected upstream change will
   fail CI rather than silently execute.

Scope of misspell unchanged: still scans .md, .txt, examples/**, all
of lib/ (excluding json.hpp), and tests/**.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bmehta001 bmehta001 requested a review from a team as a code owner May 27, 2026 13:03
@bmehta001 bmehta001 requested a review from Copilot May 27, 2026 13:03
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Hardens the spellcheck workflow with three security-focused fixes: pins misspell to v0.3.4 with SHA256 verification (replacing an unpinned curl | sh bootstrap), and adds a least-privilege permissions block scoping GITHUB_TOKEN to contents: read.

Changes:

  • Add top-level permissions: { contents: read } block to scope GITHUB_TOKEN.
  • Replace curl https://git.io/misspell | sh with a pinned release tarball download from GitHub releases.
  • Verify the tarball SHA256 against the upstream-published checksum before extraction.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants