From 3c89f96b0121e134390d26a27aff29a0ca06b38b Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Thu, 15 Jan 2026 10:51:46 -0500 Subject: [PATCH 1/3] Harden GitHub Actions workflows for security - Add workflow-level `permissions: read-all` to all workflows - Add job-level least-privilege permissions - Pin all actions to commit SHAs (actions/checkout, actionshub/chef-install, nick-fields/retry) - Pin sous-chefs reusable workflow to commit SHA - Replace `pull_request_target` with `pull_request` to prevent untrusted code execution with secrets - Add `environment: falcon-integration-testing` for secrets protection - Add `timeout-minutes: 60` to integration job - Add Chef installation verification step - Reduce lint.yml permissions (removed actions, pull-requests, issues write) - Add CODEOWNERS file for workflow and security-sensitive file review requirements - Use environment variables instead of direct matrix interpolation in shell commands --- .github/CODEOWNERS | 5 ++++ .github/workflows/ci.yml | 48 ++++++++++++++++++++++------------- .github/workflows/lint.yml | 14 +++++++--- .github/workflows/nightly.yml | 11 ++++++++ 4 files changed, 57 insertions(+), 21 deletions(-) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..0449598 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,5 @@ +# CODEOWNERS - Define code ownership for review requirements +# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners + +# Default owners for everything in the repo +* @CrowdStrike/chef-falcon-cs-maintainers diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ae7352d..ec1ac27 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,14 +1,16 @@ name: "Integration Tests" + on: push: + branches: + - main paths: - 'libraries/**' - 'resources/**' - 'test/**' - 'ohai/**' - '.github/workflows/ci.yml' - pull_request_target: - types: [labeled] + pull_request: paths: - 'libraries/**' - 'resources/**' @@ -33,14 +35,25 @@ on: description: 'Falcon API Version' required: true +# Workflow-level permissions - restrict to read-only by default +permissions: read-all + jobs: integration: + # Only run on push to main, schedule, or workflow_call + # PRs will trigger but secrets won't be available for fork PRs if: | github.event_name == 'push' || github.event_name == 'schedule' || - (github.event_name == 'pull_request_target' && - github.event.label.name == 'ok-to-test') + github.event_name == 'workflow_call' || + (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) runs-on: ubuntu-20.04 + timeout-minutes: 60 + # Use environment protection for secrets access + environment: falcon-integration-testing + # Job-level permissions - least privilege + permissions: + contents: read strategy: matrix: os: @@ -66,20 +79,18 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v3 - if: github.event_name != 'pull_request_target' - - - name: Check out code - uses: actions/checkout@v3 - with: - ref: ${{github.event.pull_request.head.sha}} - if: github.event_name == 'pull_request_target' + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Install Chef - uses: actionshub/chef-install@main + uses: actionshub/chef-install@776a917c09d87c381d1d5342f83cd554223fa49c # v3.0.1 + + - name: Verify Chef installation + run: | + chef --version + chef exec ruby --version - name: Run role tests - uses: nick-fields/retry@v2 + uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2 env: CHEF_LICENSE: accept-no-persist KITCHEN_LOCAL_YAML: kitchen.yml @@ -97,7 +108,10 @@ jobs: - name: Print debug output on failure if: failure() + env: + KITCHEN_LOCAL_YAML: kitchen.yml + TEST_INSTANCE: ${{ matrix.suite }}-${{ matrix.os }} run: | - set -x - sudo journalctl -l --since today - KITCHEN_LOCAL_YAML=kitchen.yml /usr/bin/kitchen exec ${{ matrix.suite }}-${{ matrix.os }} -c "journalctl -l" + set -x + sudo journalctl -l --since today + /usr/bin/kitchen exec "${TEST_INSTANCE}" -c "journalctl -l" diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index c2d015b..9e8307a 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -2,15 +2,21 @@ name: "Lint Tests" on: push: + branches: + - main workflow_call: pull_request: +# Workflow-level permissions - restrict to read-only by default +permissions: read-all + jobs: lint-unit: - uses: sous-chefs/.github/.github/workflows/lint-unit.yml@2.0.1 + # Pin to commit SHA for security + uses: sous-chefs/.github/.github/workflows/lint-unit.yml@1bd0cd79d49e32c55efd9227776ad90afcb2d89b # 2.0.1 + # Permissions required by the reusable workflow for status checks + # These are the minimum permissions needed for the sous-chefs lint workflow permissions: - actions: write + contents: read checks: write - pull-requests: write statuses: write - issues: write diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index df9ea9c..15cc9d6 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -5,14 +5,25 @@ on: - cron: '0 0 * * *' workflow_dispatch: +# Workflow-level permissions - restrict to read-only by default +permissions: read-all + jobs: lint-unit: name: "Run Chef lint tests" uses: ./.github/workflows/lint.yml + # Permissions inherited from called workflow + permissions: + contents: read + checks: write + statuses: write integration: name: "Run Chef integration tests" uses: ./.github/workflows/ci.yml + # Permissions inherited from called workflow + permissions: + contents: read secrets: FALCON_CLIENT_ID: ${{ secrets.FALCON_CLIENT_ID }} FALCON_CLIENT_SECRET: ${{ secrets.FALCON_CLIENT_SECRET }} From e1070a1a7a055f40996bdca258051d1cd2891e7a Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Thu, 15 Jan 2026 10:54:08 -0500 Subject: [PATCH 2/3] Add AI assistant files to ignore lists Prevent accidental commits of AI assistant configuration files: - CLAUDE.md and .claude/ (Claude Code) - .cursorrules and .cursor/ (Cursor) - .aider* (Aider) - .copilot/ and .github/copilot-* (GitHub Copilot) --- .gitignore | 10 ++++++++++ chefignore | 10 ++++++++++ 2 files changed, 20 insertions(+) diff --git a/.gitignore b/.gitignore index 829b319..a72b51c 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,13 @@ Policyfile.lock.json .idea/ .kitchen.local.yml + +# AI Assistant Files # +###################### +CLAUDE.md +.claude/ +.cursorrules +.cursor/ +.aider* +.copilot/ +.github/copilot-* diff --git a/chefignore b/chefignore index cc170ea..fe372ed 100644 --- a/chefignore +++ b/chefignore @@ -113,3 +113,13 @@ UPGRADING* ########### .vagrant Vagrantfile + +# AI Assistant Files # +###################### +CLAUDE.md +.claude/* +.cursorrules +.cursor/* +.aider* +.copilot/* +.github/copilot-* From c1713db3ce552637234d9d16e090e44602cd5a35 Mon Sep 17 00:00:00 2001 From: Carlos Matos Date: Thu, 15 Jan 2026 13:34:14 -0500 Subject: [PATCH 3/3] Fix secrets handling in nightly workflow Use `secrets: inherit` instead of explicit secret passing. This allows ci.yml's environment protection to properly gate access to secrets. The previous approach would have required secrets at repository level, bypassing environment protection. --- .github/workflows/nightly.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 15cc9d6..9cf0f2e 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -24,9 +24,5 @@ jobs: # Permissions inherited from called workflow permissions: contents: read - secrets: - FALCON_CLIENT_ID: ${{ secrets.FALCON_CLIENT_ID }} - FALCON_CLIENT_SECRET: ${{ secrets.FALCON_CLIENT_SECRET }} - FALCON_CID: ${{ secrets.FALCON_CID }} - FALCON_CLOUD: ${{ secrets.FALCON_CLOUD }} - FALCON_VERSION: ${{ secrets.FALCON_VERSION }} + # Inherit secrets - ci.yml's environment protection provides the approval gate + secrets: inherit