From 1fbea97b2a212d1738760915c9f670bd7770908a Mon Sep 17 00:00:00 2001 From: Will Sarg <12886992+willsarg@users.noreply.github.com> Date: Tue, 17 Feb 2026 13:39:47 -0500 Subject: [PATCH] ci(security): pin rustsec audit action and supersede #588 (#592) * fix(workflows): standardize runner configuration for security jobs * ci(actionlint): add Blacksmith runner label to config Add blacksmith-2vcpu-ubuntu-2404 to actionlint self-hosted-runner labels config to suppress "unknown label" warnings during workflow linting. This label is used across all workflows after the Blacksmith migration. * fix(actionlint): adjust indentation for self-hosted runner labels * feat(security): enhance security workflow with CodeQL analysis steps * fix(security): update CodeQL action to version 4 for improved analysis * fix(security): remove duplicate permissions in security workflow * fix(security): revert CodeQL action to v3 for stability The v4 version was causing workflow file validation failures. Reverting to proven v3 version that is working on main branch. * fix(security): remove duplicate permissions causing workflow validation failure The permissions block had duplicate security-events and actions keys, which caused YAML validation errors and prevented workflow execution. Fixes: workflow file validation failures on main branch * fix(security): remove pull_request trigger to reduce costs * fix(security): restore PR trigger but skip codeql on PRs * fix(security): resolve YAML syntax error in security workflow * refactor(security): split CodeQL into dedicated scheduled workflow * fix(security): update workflow name to Rust Package Security Audit * fix(codeql): remove push trigger, keep schedule and on-demand only * feat(codeql): add CodeQL configuration file to ignore specific paths * Potential fix for code scanning alert no. 39: Hard-coded cryptographic value Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * fix(ci): resolve auto-response workflow merge markers * fix(build): restore ChannelMessage reply_target usage * ci(workflows): run workflow sanity on workflow pushes for all branches * ci(workflows): rename auto-response workflow to PR Auto Responder * ci(workflows): require owner approval for workflow file changes * ci: add lint-first PR feedback gate * ci(workflows): split label policy checks from workflow sanity * ci(workflows): consolidate policy and rust workflow setup * ci: add safe pull request intake sanity checks * ci(security): switch audit to pinned rustsec audit-check --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .github/workflows/security.yml | 16 +++++++++------- docs/actions-source-policy.md | 5 +++++ docs/ci-map.md | 2 +- 3 files changed, 15 insertions(+), 8 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index bf0b99a..1e96dec 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -16,6 +16,7 @@ permissions: contents: read security-events: write actions: read + checks: write env: CARGO_TERM_COLOR: always @@ -23,13 +24,14 @@ env: jobs: audit: name: Security Audit - uses: ./.github/workflows/rust-reusable.yml - with: - timeout_minutes: 20 - toolchain: stable - run_command: | - cargo install --locked cargo-audit --version 0.22.1 - cargo audit + runs-on: blacksmith-2vcpu-ubuntu-2404 + timeout-minutes: 20 + steps: + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + + - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 + with: + token: ${{ secrets.GITHUB_TOKEN }} deny: name: License & Supply Chain diff --git a/docs/actions-source-policy.md b/docs/actions-source-policy.md index 21eb6e2..026bfe2 100644 --- a/docs/actions-source-policy.md +++ b/docs/actions-source-policy.md @@ -19,6 +19,7 @@ Selected allowlist patterns: - `DavidAnson/markdownlint-cli2-action@*` - `lycheeverse/lychee-action@*` - `EmbarkStudios/cargo-deny-action@*` +- `rustsec/audit-check@*` - `rhysd/actionlint@*` - `softprops/action-gh-release@*` - `sigstore/cosign-installer@*` @@ -79,6 +80,10 @@ Latest sweep notes: - 2026-02-16: Blacksmith migration blocked workflow execution - Added allowlist pattern: `useblacksmith/*` for self-hosted runner infrastructure - Actions: `useblacksmith/setup-docker-builder@v1`, `useblacksmith/build-push-action@v2` +- 2026-02-17: Security audit reproducibility/freshness balance update + - Added allowlist pattern: `rustsec/audit-check@*` + - Replaced inline `cargo install cargo-audit` execution with pinned `rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998` in `security.yml` + - Supersedes floating-version proposal in #588 while keeping action source policy explicit ## Rollback diff --git a/docs/ci-map.md b/docs/ci-map.md index 344ed6f..d2a47dc 100644 --- a/docs/ci-map.md +++ b/docs/ci-map.md @@ -24,7 +24,7 @@ Merge-blocking checks should stay small and deterministic. Optional checks are u - `.github/workflows/docker.yml` (`Docker`) - Purpose: PR docker smoke check and publish images on `main`/tag pushes - `.github/workflows/security.yml` (`Security Audit`) - - Purpose: dependency advisories (`cargo audit`) and policy/license checks (`cargo deny`) + - Purpose: dependency advisories (`rustsec/audit-check`, pinned SHA) and policy/license checks (`cargo deny`) - `.github/workflows/release.yml` (`Release`) - Purpose: build tagged release artifacts and publish GitHub releases - `.github/workflows/label-policy-sanity.yml` (`Label Policy Sanity`)