Skip to content

Pin CI tools and workflows to verified immutable SHAs with least privilege #13

New issue
New issue
Closed
Closed
Pin CI tools and workflows to verified immutable SHAs with least privilege#13
Labels
status:approvedApproved for implementationtype:choreMaintenance, tooling, or automation change
Milestone
B01: CI guardrails and first release readiness

Description

@egdev6
egdev6
opened on Oct 8, 2026

Goal

Pin workflow tools to verified immutable SHAs with least-privilege permissions so guardrails are reproducible.

Observations

  • Local suite passes 118/118 with 0 skips using both verified tools; this is local evidence only.
  • actionlint passes all workflow assets locally and gitleaks full history has 0 findings.
  • Tool SHAs are verified workflow constants; .github/ci-tools.json is metadata only, not the source of the pin.
  • Platform-specific declared skips are reported here; B03 addresses the critical skips.
  • Changes are uncommitted and unpushed, so no remote proof exists.

Decision gate

Approve the verified SHA set and read-only permissions before merge; no broader token scopes.

Acceptance criteria

  • Workflow actions and downloaded tools reference verified immutable SHAs.
  • Workflow permissions are explicitly least-privilege.
  • The security scanner fixture step runs without skips.
  • Platform-specific declared skips are reported, not hidden.

Verification

  • node scripts/run-tests.mjs, with GITLEAKS_BIN and ACTIONLINT_BIN pointing to checksum-verified binaries -> exit 0, 118/118, 0 skips locally.
  • actionlint over every workflow asset -> exit 0, no diagnostics.
  • gitleaks scan of full history -> exit 0, 0 findings.

Release checkpoint

Remaining risk: pins and results are local until a remote run confirms them. No release version or tag is assigned here.

Tracking

Roadmap item: B01-01. All acceptance criteria remain pending; publication does not grant approval or release authority.

Activity

  1. egdev6
    added this to the B01: CI guardrails and first release readiness milestone on Oct 8, 2026
  2. egdev6
    added
    type:choreMaintenance, tooling, or automation change
    status:approvedApproved for implementation
    on Oct 8, 2026

  3. egdev6 commented on Oct 10, 2026

    @egdev6
    egdev6
    on Oct 10, 2026
    OwnerAuthor

    ODD reconciliation: reproducible CI pins and least privilege

    • Issue: Pin CI tools and workflows to verified immutable SHAs with least privilege #13 (B01-01).
    • Planning revision: bootstrap-odd-reconcile-v2, published only after explicit approval.
    • Supersedes historical local-only observations, not the original acceptance criteria.
    • Scope: verified immutable workflow/tool references and least-privilege CI. Excludes broader token scopes, version/release changes and sandbox apply.

    Acceptance and current evidence

    Original criterion retained Evidence at immutable main
    Actions and downloaded tools reference verified immutable SHAs Workflow, action pins, Gitleaks, actionlint: full action SHAs and approved archive checksums, checked before extracting named binaries
    Explicit least-privilege permissions The workflow defaults to contents read; test/security checkouts do not persist credentials. Only the push-only release job receives contents write, after the aggregate gate
    Security scanner fixtures run without skips Main CI, attempt 1: Gitleaks 4/4, zero skipped; actionlint 4/4, zero skipped
    Platform-specific skips are reported Same Node 20.20.2 run: Ubuntu 182 passed/0 skipped; macOS and Windows 180 passed/2 inherited descriptor/procfs skips each. Those skips remain B03 work

    Historical 118-test local observations do not describe current main. CI and code evidence above do not prove live Projects, stored-secret capability, agent loading or sandbox security.

    Remaining ODD

    1. Review each original criterion against these immutable links, including pin provenance and the intentional release-job permission.
    2. Record human acceptance or any specific remaining gap. No checkbox/body/status/closure is changed by this comment.
    3. Keep the B01 release checkpoint separate: no version or tag is assigned here.

    State: acceptance reconciliation, not automatically closed or reserved. The shared roadmap will link this verified comment.

  4. egdev6 commented on Oct 11, 2026

    @egdev6
    egdev6
    on Oct 11, 2026
    OwnerAuthor

    Acceptance recorded: reproducible CI pins and least privilege

    The maintainer has accepted the read-only audit of all four original criteria for #13. This records acceptance without changing the issue's original scope or criteria.

    Evidence: immutable main 65927d8 and CI run 38097323552, with all jobs successful.

    Original criterion Verified result
    Immutable workflow/tool references All action references use full commit hashes. Upstream v4.4.0 refs resolve to checkout 11d5960a326750d5838078e36cf38b85af677262 and setup-node 49933ea5288caeca8642d1e84afbd3f7d6820020. Gitleaks 8.30.1 and actionlint 1.7.12 use approved SHA-256 literals; hosted logs confirm strict checksum verification before named-binary extraction.
    Explicit least-privilege permissions Effective test/security/aggregate tokens have contents read and metadata read. Only the push-only release job has contents write, after the successful aggregate gate. Test/security checkouts do not persist credentials; release persistence is intentional.
    Security scanner fixtures run without skips Gitleaks 4/4 and actionlint 4/4 passed, with zero failures, cancellations or skips.
    Platform skips reported honestly Ubuntu 210 passed/0 skipped; macOS 208 passed/2 skipped; Windows 207 passed/3 skipped.

    The two macOS/Windows skips cover descriptor-relative confinement and descriptor-support failure handling. Windows additionally skips native source symlinks fail closed, explicitly guarded by platform in source. These limitations remain B03 work, not native confinement or universal compatibility proof. Node 20 and moving runner labels do not establish a hermetic toolchain; hash integrity is not signed supply-chain provenance.

    The existing v1.1.0 tag and GitHub Release remain unchanged. Acceptance of #13 does not complete other roadmap items or authorize release, version changes, cleanup, broader credentials or live sandbox operations. The next release remains deferred until the agreed roadmap is accepted as complete.

    With the maintainer's explicit approval, #13 can now be marked completed. Original body, labels, assignees and milestone assignment are preserved; prior evidence remains available.

  5. egdev6
    closed this as completedon Oct 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    status:approvedApproved for implementationtype:choreMaintenance, tooling, or automation change

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions