Harden GitHub Actions workflows for security#52
Open
carlosmmatos wants to merge 3 commits intomainfrom
Open
Conversation
- Add workflow-level `permissions: read-all` to all workflows - Add job-level least-privilege permissions - Pin all actions to commit SHAs (actions/checkout, actionshub/chef-install, nick-fields/retry) - Pin sous-chefs reusable workflow to commit SHA - Replace `pull_request_target` with `pull_request` to prevent untrusted code execution with secrets - Add `environment: falcon-integration-testing` for secrets protection - Add `timeout-minutes: 60` to integration job - Add Chef installation verification step - Reduce lint.yml permissions (removed actions, pull-requests, issues write) - Add CODEOWNERS file for workflow and security-sensitive file review requirements - Use environment variables instead of direct matrix interpolation in shell commands
Prevent accidental commits of AI assistant configuration files: - CLAUDE.md and .claude/ (Claude Code) - .cursorrules and .cursor/ (Cursor) - .aider* (Aider) - .copilot/ and .github/copilot-* (GitHub Copilot)
Use `secrets: inherit` instead of explicit secret passing. This allows ci.yml's environment protection to properly gate access to secrets. The previous approach would have required secrets at repository level, bypassing environment protection.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR implements comprehensive security hardening for all GitHub Actions workflows based on a security audit. The changes follow GitHub's security best practices and address multiple critical, high, and medium severity issues.
Changes
Permissions Hardening
permissions: read-allat workflow level to all three workflowslint.ymlpermissions from 5 write scopes to 3 (removedactions,pull-requests,issues)Action Pinning (Supply Chain Security)
actions/checkoutto SHA11bd71901bbe5b1630ceea73d27597364c9af683(v4.2.2)actionshub/chef-installto SHA776a917c09d87c381d1d5342f83cd554223fa49c(v3.0.1)nick-fields/retryto SHAce71cc2ab81d554ebbe88c79ab5975992d79ba08(v3.0.2)sous-chefs/.githubworkflow to SHA1bd0cd79d49e32c55efd9227776ad90afcb2d89b(2.0.1)Critical Vulnerability Fix
pull_request_targetwithpull_request- The previous configuration could allow untrusted PR code to execute with access to repository secrets (race condition between label approval and force-push)Environment Protection
environment: falcon-integration-testingto integration jobAdditional Hardening
timeout-minutes: 60to prevent hung jobsCODEOWNERSfile requiring review for workflow and security-sensitive filesRequired Manual Configuration
The following must be configured in GitHub repository settings:
Create Environment:
falcon-integration-testingmainMove Secrets from repository to environment scope:
FALCON_CLIENT_IDFALCON_CLIENT_SECRETFALCON_CIDFALCON_CLOUDFALCON_VERSIONTest Plan