Skip to content

v0.3.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Aug 12:04
· 11 commits to main since this release
v0.3.6
dea1408
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.3.6 introduces full-repository, immutable pull-request scans for service and CI integrations, together with two important false-positive fixes.

New: immutable pull-request scans

sisakulint can now scan the exact head of a pull request without requiring callers to clone the repository themselves:

sisakulint -remote owner/repo -pr 123
sisakulint -remote https://github.com/owner/repo/pull/123

For webhook-driven services, -expected-head-sha pins the scan to the revision that triggered the job. sisakulint captures and revalidates both sides of the PR, downloads the repository archive at the immutable head SHA, and analyzes the complete repository so project-wide rules, lockfiles, local actions, and reusable workflows remain available as context.

Only workflows changed by the PR are reported. Use repeatable -remote-target flags to narrow that report/fix scope further. -fix dry-run can preview fixes; applying -fix on requires a new -remote-checkout-dir, and sisakulint never writes directly to GitHub.

Snapshot acquisition fails closed with HTTPS-only redirects, credential stripping across archive redirects, PR file and page limits, revision revalidation, and strict archive traversal, link, duplicate-path, entry-count, compressed-size, extracted-size, and per-file checks. Private repositories can use token flags/environment variables, gh auth, or Git credentials. Remote scans currently support GitHub.com only. #567

False-positive fixes

  • Fixed artifact-poisoning-critical for same-run artifact fan-in. A workflow without a privileged trigger is no longer flagged merely because it downloads an artifact to a workspace-relative path. Explicit cross-run downloads and privileged-trigger paths remain covered. #553
  • Fixed impostor-commit for valid SHA pins on older action major versions. The independent tag-ancestry comparison window now covers 30 tags instead of 10, preventing newer major releases from pushing a valid older ancestor outside the verification window. #569

Security and reliability

  • Hardened GitHub Actions workflows with narrower token permissions, immutable action pins, disabled persisted checkout credentials and build caches where appropriate, consistent CodeQL action versions, and bounded job timeouts. #558
  • Strengthened CI with race-enabled tests, reachable-vulnerability checks, parser fuzz coverage, and a security policy. The project now targets Go 1.25.12, and releases pin GoReleaser v2.15.3. #558
  • Added bounded GitHub API requests and PR file pagination, explicit compressed-archive limit errors, and regression coverage for credential-host and archive-redirect boundaries. #567

Maintenance

  • Updated grouped CodeQL action dependencies and OpenSSF Scorecard to v2.4.4. #559, #563, #564
  • Removed the unused Dockerfile and its stale maintenance references. Supported distribution remains Homebrew, release binaries, go install, and the sisakulint GitHub Action. #558

Upgrade

brew upgrade sisakulint

# Or install directly with Go:
go install github.com/sisaku-security/sisakulint/cmd/sisakulint@v0.3.6

Full changelog: v0.3.5...v0.3.6

Assets 8
Loading