1- # Reusable: security-static + CodeQL gate.
1+ # Reusable: security-static + license gate.
2+ # CodeQL is not here: PRs do not run it. It runs on push to main, weekly, and
3+ # inside dry-run.yml / release.yml, which call codeql.yml directly.
24# Runs independently from lint/test/build — does not block the main pipeline.
35# Affects overall workflow success status.
46name : Security Gate
57
68on :
7- workflow_call : {}
9+ workflow_call :
10+ inputs :
11+ lanes :
12+ description : ' PR lane selection (scripts/ci/select-lanes.sh JSON list); "all" = every job (dry run, release)'
13+ type : string
14+ default : all
815
916permissions :
1017 contents : read
@@ -16,19 +23,28 @@ jobs:
1623 steps :
1724 - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
1825 - name : " Layer 1: Static allow-list audit"
19- run : scripts/security-audit.sh
26+ run : |
27+ bash tests/test_security_audit_subprocess_calls.sh
28+ scripts/security-audit.sh
2029name : " Layer 6: UI security audit"
21- run : scripts/security-ui.sh
30+ run : |
31+ bash tests/test_security_ui_urls.sh
32+ scripts/security-ui.sh
2233name : " Layer 8: Vendored dependency integrity"
2334 run : scripts/security-vendored.sh
2435
2536 license-gate :
37+ if : ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'license-gate') }}
2638 runs-on : ubuntu-latest
2739 timeout-minutes : 240
2840 steps :
2941 - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3042 - name : Install ScanCode Toolkit
31- run : pipx install scancode-toolkit
43+ # Pinned: an unpinned install picked up pluggy 1.7.0, which breaks
44+ # scancode at import (see .github/scancode-constraints.txt).
45+ env :
46+ PIP_CONSTRAINT : ${{ github.workspace }}/.github/scancode-constraints.txt
47+ run : pipx install scancode-toolkit==32.5.0
3248 - name : " Gate self-test (a planted violation must be detected)"
3349 run : scripts/license-gate.sh --selftest
3450 - name : " License compliance gate (one finding fails)"
3854 GH_TOKEN : ${{ secrets.GITHUB_TOKEN }}
3955 run : scripts/audit-license-provenance.py
4056
41- codeql-gate :
42- runs-on : ubuntu-latest
43- timeout-minutes : 240
44- # Without security-events:read this job inherits the workflow's
45- # contents:read, the code-scanning alert API answers 403, and the gate
46- # below reported "0 alerts" on every run it has ever made. actions:read is
47- # what the CodeQL-run poll above needs for the same reason.
48- permissions :
49- contents : read
50- security-events : read
51- actions : read
52- steps :
53- - name : Wait for CodeQL on current commit (max 150 min)
54- env :
55- GH_TOKEN : ${{ secrets.GITHUB_TOKEN }}
56- run : |
57- # On pull_request events github.sha is the synthetic merge commit;
58- # CodeQL runs are recorded against the PR head SHA.
59- CURRENT_SHA="${{ github.event.pull_request.head.sha || github.sha }}"
60- echo "Waiting for CodeQL to complete on $CURRENT_SHA..."
61- # 300 attempts x 30s = 150 min. The previous budget was 90 x 30s = 45 min,
62- # which is shorter than CodeQL actually takes on this repository: a measured
63- # run on PR #1426 (head 7b72652a) completed with conclusion=success after
64- # 124 min, 7 minutes AFTER this gate had already given up. That marked at
65- # least five contributor PRs red for a scan that passed. The job's own
66- # timeout-minutes is 240, so 150 still leaves headroom.
67- for attempt in $(seq 1 300); do
68- LATEST=$(gh api "repos/${{ github.repository }}/actions/workflows/codeql.yml/runs?head_sha=$CURRENT_SHA&per_page=1" \
69- --jq '.workflow_runs[] | "\(.conclusion) \(.status)"' 2>/dev/null | head -1 || echo "")
70- if [ -z "$LATEST" ]; then
71- echo " $attempt/300: no run yet..."; sleep 30; continue
72- fi
73- CONCLUSION=$(echo "$LATEST" | cut -d' ' -f1)
74- STATUS=$(echo "$LATEST" | cut -d' ' -f2)
75- if [ "$STATUS" = "completed" ] && [ "$CONCLUSION" = "success" ]; then
76- echo "=== CodeQL passed ==="; exit 0
77- elif [ "$STATUS" = "completed" ]; then
78- echo "BLOCKED: CodeQL $CONCLUSION"; exit 1
79- fi
80- echo " $attempt/300: $STATUS..."; sleep 30
81- done
82- echo "BLOCKED: CodeQL timeout"; exit 1
83-
84- name : Check for open code scanning alerts
85- env :
86- GH_TOKEN : ${{ secrets.GITHUB_TOKEN }}
87- run : |
88- # FAIL CLOSED. The previous form was `gh api ... 2>/dev/null || echo "0"`,
89- # which looks defensive and is the opposite. gh writes the API error
90- # BODY to stdout, so a 403 made ALERTS the string
91- # {"message":"Resource not accessible by integration",...,"status":"403"}0
92- # every `[` comparison then failed as non-integer, the `if` took its
93- # false branch, and the step printed "CodeQL gate passed (0 alerts)"
94- # and exited 0. That is exactly how a security gate should NEVER fail:
95- # silently, in the direction of "everything is fine". An unreadable
96- # alert list is now an error, not a zero.
97- # NOTE: this runs in a command substitution, so it must `return`, not
98- # `exit` -- an `exit` here would only end the subshell and let the
99- # caller continue with an empty count, recreating the very bug this
100- # replaces. The callers below check the status explicitly.
101- count_open_alerts() {
102- local body status
103- body=$(gh api 'repos/${{ github.repository }}/code-scanning/alerts?state=open' \
104- --jq 'length' 2>/dev/null)
105- status=$?
106- if [ $status -ne 0 ]; then
107- echo "BLOCKED: cannot read code scanning alerts (gh exit $status)." >&2
108- echo " Refusing to treat an unreadable alert list as zero." >&2
109- echo " Most likely cause: the job lacks security-events:read." >&2
110- return 1
111- fi
112- case "$body" in
113- ''|*[!0-9]*)
114- echo "BLOCKED: alert count was not a number: ${body:-<empty>}" >&2
115- return 1
116- ;;
117- esac
118- printf '%s' "$body"
119- }
120- echo "Waiting 60s for alert API to settle..."
121- sleep 60
122- ALERTS=$(count_open_alerts) || exit 1
123- sleep 15
124- ALERTS2=$(count_open_alerts) || exit 1
125- [ "$ALERTS" -lt "$ALERTS2" ] && ALERTS=$ALERTS2
126- if [ "$ALERTS" -gt 0 ]; then
127- echo "BLOCKED: $ALERTS open alert(s)"
128- gh api 'repos/${{ github.repository }}/code-scanning/alerts?state=open' \
129- --jq '.[] | " #\(.number) [\(.rule.security_severity_level // .rule.severity)] \(.rule.id) — \(.most_recent_instance.location.path):\(.most_recent_instance.location.start_line)"' 2>/dev/null || true
130- exit 1
131- fi
132- echo "=== CodeQL gate passed (0 alerts) ==="
0 commit comments