Skip to content

Commit a345848

Browse files
thepixelabssemantic-release-botclaude
authored
fix(ci): upgrade GitHub Actions to Node 24 and harden supply chain (#11)
## Summary - Upgrade all GitHub first-party actions from Node 20 to Node 24 runtime - SHA-pin third-party actions (TruffleHog, OSV Scanner) to prevent tag substitution attacks ## Changes ### Node 24 upgrades | Action | Before | After | |---|---|---| | `actions/checkout` | `@v4` | `@v6` | | `actions/setup-node` | `@v4` | `@v6` | | `actions/cache` | `@v4` | `@v5` | | `actions/dependency-review-action` | `@v4` | `@v4.9.0` (latest, still Node 20) | Node 20 support is removed from GitHub runners on 2026-09-16, with forced default switch to Node 24 on 2026-06-02. ### Supply chain hardening Third-party actions pinned by commit SHA instead of tag to prevent tag substitution attacks (as exploited in the [Trivy supply chain compromise](GHSA-69fq-xp46-6x23) of March 2026). First-party `actions/*` remain tag-pinned — compromising them requires compromising GitHub itself, which is a different threat model. ## Test plan - [ ] All security jobs pass without Node 20 deprecation warnings - [ ] TruffleHog and OSV Scanner resolve correctly via SHA pins --------- Co-authored-by: semantic-release-bot <[email protected]> Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>
1 parent 975ed91 commit a345848

File tree

10 files changed

+37
-37
lines changed

10 files changed

+37
-37
lines changed

‎.github/workflows/security.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ jobs:
1818
name: npm audit
1919
runs-on: ubuntu-latest
2020
steps:
21-
- uses: actions/checkout@v4
22-
- uses: actions/setup-node@v4
21+
- uses: actions/checkout@v6
22+
- uses: actions/setup-node@v6
2323
with:
2424
node-version-file: '.node-version'
2525
check-latest: false
2626
- name: Cache node_modules
27-
uses: actions/cache@v4
27+
uses: actions/cache@v5
2828
id: cache-node-modules
2929
with:
3030
path: node_modules
@@ -44,8 +44,8 @@ jobs:
4444
runs-on: ubuntu-latest
4545
if: github.event_name == 'pull_request'
4646
steps:
47-
- uses: actions/checkout@v4
48-
- uses: actions/dependency-review-action@v4
47+
- uses: actions/checkout@v6
48+
- uses: actions/dependency-review-action@v4.9.0
4949
with:
5050
fail-on-severity: high
5151
deny-licenses: GPL-3.0, AGPL-3.0
@@ -57,7 +57,7 @@ jobs:
5757
name: OSV Scanner
5858
runs-on: ubuntu-latest
5959
steps:
60-
- uses: actions/checkout@v4
60+
- uses: actions/checkout@v6
6161
- uses: google/osv-scanner-action/osv-scanner-action@c51854704019a247608d928f370c98740469d4b5 # v2.3.5
6262
with:
6363
scan-args: |-
@@ -70,12 +70,12 @@ jobs:
7070
runs-on: ubuntu-latest
7171
if: github.event_name == 'pull_request'
7272
steps:
73-
- uses: actions/checkout@v4
73+
- uses: actions/checkout@v6
7474
with:
7575
fetch-depth: 0
7676
- name: TruffleHog scan
7777
id: trufflehog
78-
uses: trufflesecurity/[email protected]
78+
uses: trufflesecurity/trufflehog@6bd2d14f7a4bc1e569fa3550efa7ec632a4fa67b # v3.94.2
7979
continue-on-error: true
8080
with:
8181
path: ./
@@ -95,11 +95,11 @@ jobs:
9595
runs-on: ubuntu-latest
9696
if: github.event_name == 'schedule'
9797
steps:
98-
- uses: actions/checkout@v4
98+
- uses: actions/checkout@v6
9999
with:
100100
fetch-depth: 0
101101
- name: TruffleHog full history scan
102-
uses: trufflesecurity/[email protected]
102+
uses: trufflesecurity/trufflehog@6bd2d14f7a4bc1e569fa3550efa7ec632a4fa67b # v3.94.2
103103
with:
104104
path: ./
105105
extra_args: >-

‎agents/ceo.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -121,12 +121,12 @@ EOF
121121
```
122122
Using `>>` is atomic at the filesystem level and avoids overwriting prior entries.
123123

124-
8. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
124+
9. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
125125

126-
9. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
126+
10. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
127127

128128
### Stuck task recovery
129-
If a phase has been `IN_PROGRESS` for over 30 minutes with no new execution-log entries, a planner may reset it to `TODO` for reassignment.
129+
Stale recovery is now handled automatically by step 3 of the executor workflow. Every agent that activates will reset phases that have been IN_PROGRESS for over 30 minutes (based on `claimed_at` timestamp). Phases without a `claimed_at` field are treated as stale immediately.
130130

131131
### Security rules
132132
- Never write `.env` file contents, API keys, credentials, or secrets into any `.tasks/` file.

‎agents/compliance-counsel.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -126,12 +126,12 @@ EOF
126126
```
127127
Using `>>` is atomic at the filesystem level and avoids overwriting prior entries.
128128

129-
8. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
129+
9. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
130130

131-
9. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
131+
10. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
132132

133133
### Stuck task recovery
134-
If a phase has been `IN_PROGRESS` for over 30 minutes with no new execution-log entries, a planner may reset it to `TODO` for reassignment.
134+
Stale recovery is now handled automatically by step 3 of the executor workflow. Every agent that activates will reset phases that have been IN_PROGRESS for over 30 minutes (based on `claimed_at` timestamp). Phases without a `claimed_at` field are treated as stale immediately.
135135

136136
### Security rules
137137
- Never write `.env` file contents, API keys, credentials, or secrets into any `.tasks/` file.

‎agents/creative-technologist.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,12 +127,12 @@ EOF
127127
```
128128
Using `>>` is atomic at the filesystem level and avoids overwriting prior entries.
129129

130-
8. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
130+
9. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
131131

132-
9. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
132+
10. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
133133

134134
### Stuck task recovery
135-
If a phase has been `IN_PROGRESS` for over 30 minutes with no new execution-log entries, a planner may reset it to `TODO` for reassignment.
135+
Stale recovery is now handled automatically by step 3 of the executor workflow. Every agent that activates will reset phases that have been IN_PROGRESS for over 30 minutes (based on `claimed_at` timestamp). Phases without a `claimed_at` field are treated as stale immediately.
136136

137137
### Security rules
138138
- Never write `.env` file contents, API keys, credentials, or secrets into any `.tasks/` file.

‎agents/cto.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -124,12 +124,12 @@ EOF
124124
```
125125
Using `>>` is atomic at the filesystem level and avoids overwriting prior entries.
126126

127-
8. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
127+
9. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
128128

129-
9. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
129+
10. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
130130

131131
### Stuck task recovery
132-
If a phase has been `IN_PROGRESS` for over 30 minutes with no new execution-log entries, a planner may reset it to `TODO` for reassignment.
132+
Stale recovery is now handled automatically by step 3 of the executor workflow. Every agent that activates will reset phases that have been IN_PROGRESS for over 30 minutes (based on `claimed_at` timestamp). Phases without a `claimed_at` field are treated as stale immediately.
133133

134134
### Security rules
135135
- Never write `.env` file contents, API keys, credentials, or secrets into any `.tasks/` file.

‎agents/data-engineer.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -133,12 +133,12 @@ EOF
133133
```
134134
Using `>>` is atomic at the filesystem level and avoids overwriting prior entries.
135135

136-
8. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
136+
9. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
137137

138-
9. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
138+
10. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
139139

140140
### Stuck task recovery
141-
If a phase has been `IN_PROGRESS` for over 30 minutes with no new execution-log entries, a planner may reset it to `TODO` for reassignment.
141+
Stale recovery is now handled automatically by step 3 of the executor workflow. Every agent that activates will reset phases that have been IN_PROGRESS for over 30 minutes (based on `claimed_at` timestamp). Phases without a `claimed_at` field are treated as stale immediately.
142142

143143
### Security rules
144144
- Never write `.env` file contents, API keys, credentials, or secrets into any `.tasks/` file.

‎agents/devops.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -131,12 +131,12 @@ EOF
131131
```
132132
Using `>>` is atomic at the filesystem level and avoids overwriting prior entries.
133133

134-
8. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
134+
9. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
135135

136-
9. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
136+
10. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
137137

138138
### Stuck task recovery
139-
If a phase has been `IN_PROGRESS` for over 30 minutes with no new execution-log entries, a planner may reset it to `TODO` for reassignment.
139+
Stale recovery is now handled automatically by step 3 of the executor workflow. Every agent that activates will reset phases that have been IN_PROGRESS for over 30 minutes (based on `claimed_at` timestamp). Phases without a `claimed_at` field are treated as stale immediately.
140140

141141
### Security rules
142142
- Never write `.env` file contents, API keys, credentials, or secrets into any `.tasks/` file.

‎agents/product-engineer.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -135,12 +135,12 @@ EOF
135135
```
136136
Using `>>` is atomic at the filesystem level and avoids overwriting prior entries.
137137

138-
8. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
138+
9. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
139139

140-
9. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
140+
10. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
141141

142142
### Stuck task recovery
143-
If a phase has been `IN_PROGRESS` for over 30 minutes with no new execution-log entries, a planner may reset it to `TODO` for reassignment.
143+
Stale recovery is now handled automatically by step 3 of the executor workflow. Every agent that activates will reset phases that have been IN_PROGRESS for over 30 minutes (based on `claimed_at` timestamp). Phases without a `claimed_at` field are treated as stale immediately.
144144

145145
### Security rules
146146
- Never write `.env` file contents, API keys, credentials, or secrets into any `.tasks/` file.

‎agents/qa-architect.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -140,12 +140,12 @@ EOF
140140
```
141141
Using `>>` is atomic at the filesystem level and avoids overwriting prior entries.
142142

143-
8. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
143+
9. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
144144

145-
9. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
145+
10. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
146146

147147
### Stuck task recovery
148-
If a phase has been `IN_PROGRESS` for over 30 minutes with no new execution-log entries, a planner may reset it to `TODO` for reassignment.
148+
Stale recovery is now handled automatically by step 3 of the executor workflow. Every agent that activates will reset phases that have been IN_PROGRESS for over 30 minutes (based on `claimed_at` timestamp). Phases without a `claimed_at` field are treated as stale immediately.
149149

150150
### Security rules
151151
- Never write `.env` file contents, API keys, credentials, or secrets into any `.tasks/` file.

‎agents/qa-engineer.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,12 +127,12 @@ EOF
127127
```
128128
Using `>>` is atomic at the filesystem level and avoids overwriting prior entries.
129129

130-
8. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
130+
9. **Block:** If you cannot proceed, edit the phase to `status: BLOCKED` and append explanation to execution-log.md via the same `>>` pattern.
131131

132-
9. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
132+
10. **Idle:** If no phases match your persona with TODO status (and prior phases DONE), report "No active tasks found for @<persona>" and stop.
133133

134134
### Stuck task recovery
135-
If a phase has been `IN_PROGRESS` for over 30 minutes with no new execution-log entries, a planner may reset it to `TODO` for reassignment.
135+
Stale recovery is now handled automatically by step 3 of the executor workflow. Every agent that activates will reset phases that have been IN_PROGRESS for over 30 minutes (based on `claimed_at` timestamp). Phases without a `claimed_at` field are treated as stale immediately.
136136

137137
### Security rules
138138
- Never write `.env` file contents, API keys, credentials, or secrets into any `.tasks/` file.

0 commit comments

Comments
 (0)