ci(security): add informational security checks - #2930
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
🌿 Preview your docs: https://nvidia-preview-pr-2930.docs.buildwithfern.com/openshell |
|
/ok to test 1a6053e |
1a6053e to
228bf5a
Compare
|
/ok to test 228bf5a |
228bf5a to
8e2b40d
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
| github.event.workflow_run.conclusion == 'success' && | ||
| github.event.workflow_run.name == 'CodeQL' && | ||
| github.event.workflow_run.head_repository.full_name != github.repository && | ||
| github.event.workflow_run.pull_requests[0].number != null |
There was a problem hiding this comment.
https://github.com/orgs/community/discussions/25220
If this is still the case this report upload might not work
There was a problem hiding this comment.
Good catch fixed. Fork PRs now upload SARIF directly so we no longer depend on workflow_run.pull_requests
| if: >- | ||
| steps.analyze.outcome == 'success' && | ||
| (github.event_name != 'pull_request' || | ||
| github.event.pull_request.head.repo.full_name == github.repository) |
There was a problem hiding this comment.
[P2] Dependabot PRs are treated like fork PRs for GITHUB_TOKEN permissions, but their head repository still equals github.repository. This condition therefore runs upload-sarif with a read-only token, so the security-events: write upload will fail. Please exclude Dependabot here and route its retained SARIF through the trusted workflow_run uploader as another restricted-token context.
There was a problem hiding this comment.
Code Scanning explicitly allows SARIF uploads from pull_request runs including Dependabot even with a read-only token (https://docs.github.com/en/code-security/reference/code-scanning/troubleshoot-analysis-errors/resource-not-accessible#confirming-the-cause-of-the-error). However I simplified the workflow to upload directly.
8d167d2 to
44ccaba
Compare
Signed-off-by: Adrien Langou <alangou@nvidia.com>
adb5b9c to
e268047
Compare
4 participants
Summary
Add observation-mode security checks for GitHub Actions, dependency changes, and the Rust/SDK codebase. Findings remain informational while scanner, configuration, and build failures stay visible.
Related Issue
Refs #2837
This PR implements the initial scanner-observation tranche and does not close the broader repository-hardening issue.
Changes
Testing
mise run pre-commitpassesmise run cipasses the existing suitemise run security:actionlintmise run security:zizmorChecklist