Skip to content

Harden dependency supply chain security #463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Harun Wangereka (wangerekaharun) merged 6 commits into from
Apr 20, 2026
Merged

Harden dependency supply chain security #463

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
2be41b2
Harden dependency supply chain security
beastawakens Apr 3, 2026
44ae1f4
fix: address review feedback on audit workflow and dependency config
beastawakens Apr 3, 2026
97bd777
Merge branch 'main' into dependency-hardening
wangerekaharun Apr 9, 2026
f27f775
Merge branch 'main' into dependency-hardening
beastawakens Apr 19, 2026
4d514b9
fix: pin Ruby to 3.4 in audit workflow for ffi compatibility
beastawakens Apr 19, 2026
e25359d
Merge branch 'main' into dependency-hardening
wangerekaharun Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/actions/setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ runs:
shell: bash

- name: Cache Ruby gems
uses: actions/cache@v4
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
with:
path: vendor/bundle
key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
Expand All @@ -54,3 +54,5 @@ runs:
- name: Install Ruby Gems
run: bundle install --jobs 4 --retry 3
shell: bash
env:
BUNDLE_FROZEN: "true"
5 changes: 3 additions & 2 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ version: 2
updates:
- package-ecosystem: github-actions
directory: /
open-pull-requests-limit: 5
schedule:
interval: weekly
day: monday
Expand All @@ -11,21 +12,21 @@ updates:
- '*'
- package-ecosystem: "swift"
directory: "/"
open-pull-requests-limit: 5
schedule:
interval: "weekly"
day: monday
groups:
swift-dependencies:
patterns:
- '*'

- package-ecosystem: "bundler"
directory: "/"
open-pull-requests-limit: 0
schedule:
interval: "weekly"
day: monday
groups:
bundler-dependencies:
patterns:
- '*'

44 changes: 44 additions & 0 deletions .github/workflows/audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
name: Security Audit

on:
pull_request:
paths:
- 'Gemfile'
- 'Gemfile.lock'
workflow_dispatch:
schedule:
- cron: '0 9 * * *'

jobs:
ruby-audit:
name: Ruby Security Audit
runs-on: ubuntu-latest
permissions:
contents: read
issues: write
env:
BUNDLE_FROZEN: "true"
steps:
Comment on lines +16 to +21
Copy link

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This job grants issues: write even when running on pull_request events. Since pull_request workflows execute code from the PR branch, it’s safer to keep PR permissions read-only and only grant issues: write for the scheduled/dispatch run that may create issues (e.g., split into two jobs with different permissions + if: conditions).

Copilot uses AI. Check for mistakes.
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
Copy link
Copy Markdown
Contributor

@prfectionist prfectionist Bot Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The pinned SHA de0fac2e4500dabe0009e67214ff5f5447ce83dd for actions/checkout does not correspond to any known v6 release (v6 doesn't exist yet as of the known releases; the latest stable is v4). Verify this SHA is correct and points to a legitimate commit in the actions/checkout repository to avoid a supply chain attack vector or workflow failure. [security, importance: 7]

Suggested change
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

- uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1
with:
ruby-version: "3.4"
bundler-cache: true
- name: Update advisory database
run: bundle exec bundler-audit update
- name: Run bundler-audit
run: bundle exec bundler-audit check
Comment on lines +22 to +30
Copy link

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI hardening enforces BUNDLE_FROZEN in other workflows/composite actions, but this audit workflow doesn’t set it. Without frozen, Bundler may rewrite Gemfile.lock (e.g., platform sections) during bundler-cache installs, which can hide drift. Consider setting BUNDLE_FROZEN: "true" at the job level (or configuring Bundler frozen mode) before running bundle exec bundler-audit.

Copilot uses AI. Check for mistakes.
- name: Create issue on failure
if: failure() && github.event_name != 'pull_request'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
EXISTING=$(gh issue list --label "security-audit" --state open --json number --jq 'length')
if [ "$EXISTING" -gt 0 ]; then exit 0; fi
TITLE_DATE=$(date +%Y-%m-%d)
gh label create "security-audit" --description "Automated security audit findings" --color "D93F0B" 2>/dev/null || true
gh label create "priority:high" --description "High priority" --color "B60205" 2>/dev/null || true
gh issue create \
--title "Security: Ruby dependency vulnerabilities detected (${TITLE_DATE})" \
--label "security-audit,priority:high" \
--body "The daily security audit has detected vulnerabilities. See [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details."
Comment on lines +31 to +44
Copy link
Copy Markdown
Contributor

@prfectionist prfectionist Bot Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The label priority:high may not exist in the repository, causing gh issue create to fail silently or with an error. More importantly, the --label flag expects labels that already exist. Consider creating labels beforehand or using only the security-audit label. Also, the step lacks permissions: issues: write at the job level — though it's present, the GITHUB_TOKEN in PRs from forks won't have write access, so this is acceptable given the github.event_name != 'pull_request' guard. [general, importance: 6]

Suggested change
- name: Create issue on failure
if: failure() && github.event_name != 'pull_request'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
EXISTING=$(gh issue list --label "security-audit" --state open --json number --jq 'length')
if [ "$EXISTING" -gt 0 ]; then exit 0; fi
TITLE_DATE=$(date +%Y-%m-%d)
gh issue create \
--title "Security: Ruby dependency vulnerabilities detected (${TITLE_DATE})" \
--label "security-audit,priority:high" \
--body "The daily security audit has detected vulnerabilities. See [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details."
- name: Create issue on failure
if: failure() && github.event_name != 'pull_request'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
EXISTING=$(gh issue list --label "security-audit" --state open --json number --jq 'length')
if [ "$EXISTING" -gt 0 ]; then exit 0; fi
TITLE_DATE=$(date +%Y-%m-%d)
gh label create "security-audit" --description "Automated security audit findings" --color "D93F0B" 2>/dev/null || true
gh label create "priority:high" --description "High priority" --color "B60205" 2>/dev/null || true
gh issue create \
--title "Security: Ruby dependency vulnerabilities detected (${TITLE_DATE})" \
--label "security-audit,priority:high" \
--body "The daily security audit has detected vulnerabilities. See [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details."

2 changes: 1 addition & 1 deletion .github/workflows/auto-author-assign.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,4 @@ jobs:
if: ${{ !contains(github.event.pull_request.assignees, '') }}
runs-on: ubuntu-latest
steps:
- uses: toshimaru/auto-author-assign@v3.0.1
- uses: toshimaru/auto-author-assign@4d585cc37690897bd9015942ed6e766aa7cdb97f # v3.0.1
8 changes: 5 additions & 3 deletions .github/workflows/build-app.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,14 @@ jobs:
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Setup environment
run: bundle install
env:
BUNDLE_FROZEN: "true"

- name: Select Xcode Version
uses: maxim-lobanov/setup-xcode@v1
uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
with:
xcode-version: 16.4

Expand Down Expand Up @@ -61,7 +63,7 @@ jobs:


- name: Send Slack Notification
uses: slackapi/slack-github-action@v3.0.1
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
with:
payload: |
{
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/post_release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,19 +10,19 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout ios
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
path: ios
- name: Checkout docs
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
repository: smileidentity/docs
path: docs
token: ${{ secrets.GH_PAT }}
- name: Copy CHANGELOG.md to Release Notes
run: cp ios/CHANGELOG.md docs/integration-options/mobile/ios-v10/release-notes.md
- name: Create docs PR
uses: peter-evans/create-pull-request@v8
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
with:
token: ${{ secrets.GH_PAT }}
path: docs
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/sdk-primary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: SwiftFormat Lint
uses: docker://ghcr.io/nicklockwood/swiftformat:latest
with:
Expand All @@ -30,7 +30,7 @@ jobs:
timeout-minutes: 15
steps:
- name: Checkout
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
- name: Write Smile Config
id: write_smile_config
# Mask the config so that it doesn't show up in the logs
Expand Down Expand Up @@ -59,15 +59,15 @@ jobs:
echo "Current developer directory: $(xcode-select -p)"
ls -1 /Applications | grep Xcode || true
- name: Cache SwiftPM
uses: actions/cache@v5
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
Copy link
Copy Markdown
Contributor

@prfectionist prfectionist Bot Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The SHA 668228422ae6a00e4ad889ee87cd7109ec5666a7 is pinned as actions/cache v5, but in .github/actions/setup/action.yml the same action is pinned to a different SHA (0057852bfaa89a56745cba8c7296529d2fc39830) labeled as v4. Using different versions of the same action across the repository is inconsistent and could lead to subtle caching behavior differences. Align all actions/cache references to the same version and SHA. [general, importance: 5]

Suggested change
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5

with:
path: |
~/.swiftpm
~/Library/Caches/org.swift.swiftpm
key: ${{ runner.os }}-spm-${{ hashFiles('**/Package.resolved') }}
restore-keys: ${{ runner.os }}-spm-
- name: Cache CocoaPods (validator downloads)
uses: actions/cache@v5
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
with:
path: |
~/Library/Caches/CocoaPods
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/stale.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 1
steps:
- uses: actions/stale@v10
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
with:
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 7 days.'
stale-pr-message: 'This PR is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 7 days.'
Expand Down
1 change: 1 addition & 0 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,3 +4,4 @@ gem "xcodeproj"
gem "arkana"
gem 'cocoapods', '~> 1.16.2'
gem "rake", "~> 13.4.2"
gem 'bundler-audit', require: false
5 changes: 5 additions & 0 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ GEM
base64 (0.3.0)
benchmark (0.5.0)
bigdecimal (4.0.1)
bundler-audit (0.9.3)
bundler (>= 1.2.0)
thor (~> 1.0)
claide (1.1.0)
cocoapods (1.16.2)
addressable (~> 2.8)
Expand Down Expand Up @@ -97,6 +100,7 @@ GEM
rexml (3.4.4)
ruby-macho (2.5.1)
securerandom (0.4.1)
thor (1.5.0)
typhoeus (1.4.1)
ethon (>= 0.9.0)
tzinfo (2.0.6)
Expand All @@ -118,6 +122,7 @@ PLATFORMS

DEPENDENCIES
arkana
bundler-audit
cocoapods (~> 1.16.2)
rake (~> 13.4.2)
xcodeproj
Expand Down
Loading