Skip to content

Commit b60e8c4

Browse files
hxy91819hxy91819
authored
ci: add process exec CodeQL security shard (#92667)
Summary: - The PR adds a `process-exec-boundary` CodeQL high-security shard, wires it into the CodeQL workflow, expands PR path triggers for process-owning plugin/script paths, and updates CI docs. - PR surface: Docs +1, Config +87. Total +88 across 3 files. - Reproducibility: not applicable. this is CI/security-scanner configuration rather than a runtime bug. The behavior is source-reviewable and the exact-head `Security High (process-exec-boundary)` check passed. Automerge notes: - No ClawSweeper repair was needed after automerge opt-in. Validation: - ClawSweeper review passed for head 066d54b. - Required merge gates passed before the squash merge. Prepared head SHA: 066d54b Review: #92667 (comment) Co-authored-by: Mason Huang <[email protected]> Approved-by: hxy91819
1 parent 3ae5e98 commit b60e8c4

3 files changed

Lines changed: 89 additions & 1 deletion

File tree

‎.github/codeql/codeql-process-exec-boundary-critical-security.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: openclaw-codeql-process-exec-boundary-critical-security
2+
3+
disable-default-queries: true
4+
5+
queries:
6+
- uses: security-extended
7+
8+
query-filters:
9+
- include:
10+
precision:
11+
- high
12+
- very-high
13+
tags contain: security
14+
security-severity: /([7-9]|10)\.(\d)+/
15+
16+
paths:
17+
- src/process
18+
- src/tui/tui-local-shell.ts
19+
- src/tui/tui.ts
20+
- src/plugin-sdk/windows-spawn.ts
21+
- packages/agent-core/src/harness/env
22+
- packages/memory-host-sdk/src/host
23+
- extensions/acpx/src
24+
- extensions/bonjour/src/advertiser.ts
25+
- extensions/browser/src/browser/chrome-mcp.ts
26+
- extensions/browser/src/browser/chrome.executables.ts
27+
- extensions/browser/src/browser/chrome.ts
28+
- extensions/codex/src/app-server/sandbox-exec-server
29+
- extensions/codex/src/app-server/transport-stdio.ts
30+
- extensions/codex/src/node-cli-sessions.ts
31+
- extensions/codex-supervisor/src/json-rpc-client.ts
32+
- extensions/file-transfer/src
33+
- extensions/google-meet/src
34+
- extensions/imessage/src
35+
- extensions/memory-core/src/memory/qmd-manager.ts
36+
- extensions/memory-wiki/src/obsidian.ts
37+
- extensions/microsoft-foundry/cli.ts
38+
- extensions/ollama/src/wsl2-crash-loop-check.ts
39+
- extensions/qa-lab/src
40+
- extensions/signal/src/daemon.ts
41+
- extensions/tts-local-cli/speech-provider.ts
42+
- extensions/voice-call/src
43+
- scripts
44+
45+
paths-ignore:
46+
- "**/node_modules"
47+
- "**/coverage"
48+
- "**/*.generated.ts"
49+
- "**/*.bundle.js"
50+
- "**/*-runtime.js"
51+
- "**/*.test.ts"
52+
- "**/*.test.tsx"
53+
- "**/*.spec.ts"
54+
- "**/*.spec.tsx"
55+
- "**/*.e2e.test.ts"
56+
- "**/*.e2e.test.tsx"
57+
- "**/*test-support*"
58+
- "**/*test-helper*"
59+
- "**/*mock*"
60+
- "**/*fixture*"
61+
- "**/*bench*"

‎.github/workflows/codeql.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,28 @@ on:
1717
- ".github/actions/**"
1818
- ".github/codeql/**"
1919
- ".github/workflows/**"
20+
- "extensions/acpx/src/**"
21+
- "extensions/bonjour/src/advertiser.ts"
22+
- "extensions/browser/src/browser/chrome-mcp.ts"
23+
- "extensions/browser/src/browser/chrome.executables.ts"
24+
- "extensions/browser/src/browser/chrome.ts"
25+
- "extensions/codex/src/app-server/sandbox-exec-server/**"
26+
- "extensions/codex/src/app-server/transport-stdio.ts"
27+
- "extensions/codex/src/node-cli-sessions.ts"
28+
- "extensions/codex-supervisor/src/json-rpc-client.ts"
29+
- "extensions/file-transfer/src/**"
30+
- "extensions/google-meet/src/**"
31+
- "extensions/imessage/src/**"
32+
- "extensions/memory-core/src/memory/qmd-manager.ts"
33+
- "extensions/memory-wiki/src/obsidian.ts"
34+
- "extensions/microsoft-foundry/cli.ts"
35+
- "extensions/ollama/src/wsl2-crash-loop-check.ts"
36+
- "extensions/qa-lab/src/**"
37+
- "extensions/signal/src/daemon.ts"
38+
- "extensions/tts-local-cli/speech-provider.ts"
39+
- "extensions/voice-call/src/**"
2040
- "packages/**"
41+
- "scripts/**"
2142
- "src/**"
2243
push:
2344
branches:
@@ -67,6 +88,11 @@ jobs:
6788
runs_on: ubuntu-24.04
6889
timeout_minutes: 25
6990
config_file: ./.github/codeql/codeql-mcp-process-tool-boundary-critical-security.yml
91+
- language: javascript-typescript
92+
category: process-exec-boundary
93+
runs_on: ubuntu-24.04
94+
timeout_minutes: 25
95+
config_file: ./.github/codeql/codeql-process-exec-boundary-critical-security.yml
7096
- language: javascript-typescript
7197
category: plugin-trust-boundary
7298
runs_on: ubuntu-24.04

‎docs/ci.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -487,7 +487,7 @@ For normal PRs, follow scoped CI/check evidence instead of treating parity as a
487487

488488
The `CodeQL` workflow is intentionally a narrow first-pass security scanner, not the full repository sweep. Daily, manual, and non-draft pull request guard runs scan Actions workflow code plus the highest-risk JavaScript/TypeScript surfaces with high-confidence security queries filtered to high/critical `security-severity`.
489489

490-
The pull request guard stays light: it only starts for changes under `.github/actions`, `.github/codeql`, `.github/workflows`, `packages`, or `src`, and it runs the same high-confidence security matrix as the scheduled workflow. Android and macOS CodeQL stay out of PR defaults.
490+
The pull request guard stays light: it only starts for changes under `.github/actions`, `.github/codeql`, `.github/workflows`, `packages`, `scripts`, `src`, or process-owning bundled plugin runtime paths, and it runs the same high-confidence security matrix as the scheduled workflow. Android and macOS CodeQL stay out of PR defaults.
491491

492492
### Security categories
493493

@@ -497,6 +497,7 @@ The pull request guard stays light: it only starts for changes under `.github/ac
497497
| `/codeql-security-high/channel-runtime-boundary` | Core channel implementation contracts plus the channel plugin runtime, gateway, Plugin SDK, secrets, audit touchpoints |
498498
| `/codeql-security-high/network-ssrf-boundary` | Core SSRF, IP parsing, network guard, web-fetch, and Plugin SDK SSRF policy surfaces |
499499
| `/codeql-security-high/mcp-process-tool-boundary` | MCP servers, process execution helpers, outbound delivery, and agent tool-execution gates |
500+
| `/codeql-security-high/process-exec-boundary` | Local shell, process spawn helpers, subprocess-owning bundled plugin runtimes, and workflow script glue |
500501
| `/codeql-security-high/plugin-trust-boundary` | Plugin install, loader, manifest, registry, package-manager install, source-loading, and Plugin SDK package contract trust surfaces |
501502

502503
### Platform-specific security shards

0 commit comments

Comments
 (0)