Security audit: SHA-pin remaining GitHub Actions workflow - #41
Merged
Conversation
codeql.yml was the only workflow still referencing third-party actions by
mutable major-version tag (actions/checkout@v4, github/codeql-action/
{init,autobuild,analyze}@V3). Every other workflow (ci.yml, release.yml,
benchmark.yml, scorecard.yml) was already SHA-pinned from a prior
campaign, including release.yml, which holds the PyPI publish token.
Pinned all four steps to the same commit SHAs already used elsewhere in
this repo for these exact tags, verified against the GitHub API as real
commits on the respective upstream repos.
Rescanned the two other items flagged for this pass and found both
already resolved on main, so no further code change was needed:
- The Windows path-separator bug in LocalDirRemoteFixtureBackend.list_keys
(src/agent_trace/exporters/remote_fixture.py) was already fixed in
0.1.7 (commit 5ce05fe) via .as_posix(), with a regression test
(tests/unit/test_remote_fixture.py::test_list_keys_returns_matching_prefix)
that runs on real windows-latest CI runners.
- The published package name is confirmed as agent-observability-trace-cli
(live on PyPI at 0.1.11; pyproject.toml name field matches). agent-trace
is the CLI entry-point command, not a separate installable package name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fresh security-audit pass over this repo. Rescanned the three items flagged in a prior review and fixed the one still open:
codeql.ymlwas the only workflow still referencing third-party actions by mutable tag (actions/checkout@v4,github/codeql-action/{init,autobuild,analyze}@v3). Pinned all four steps to the same commit SHAs already used elsewhere in this repo for these exact tags (verified against the GitHub API as real commits on the respective upstream repos).ci.yml,release.yml— which holds the PyPI publish token,benchmark.yml,scorecard.yml) was already SHA-pinned from a prior campaign.LocalDirRemoteFixtureBackend.list_keys(src/agent_trace/exporters/remote_fixture.py) was fixed in 0.1.7 (commit5ce05fe) via.as_posix(), with a regression test that runs on realwindows-latestCI runners.agent-observability-trace-cli(live at 0.1.11), matchingpyproject.toml'snamefield and every install command in the repo's README.agent-traceis the CLI entry-point command ([project.scripts]), not a separate installable package name.Test plan
uv run --frozen pytest tests/unit/ --cov=src/ --cov-fail-under=80→ 1202 passed, 3 skipped, 90.49% coverage (CI's exactqualityjob command)uv run --frozen ruff check src/ tests/ benchmarks/→ all checks passeduv run --frozen ruff format --check src/ tests/ benchmarks/→ passedcodeql.yml's new SHAs resolve to real commits onactions/checkoutandgithub/codeql-actionviagh apiNote: a full
uv sync/uv lockre-resolution currently fails independent of this PR —pydantic-ai>=2.0(viafastmcp-slim, capped atmcp<2.0) conflicts with themcp-serverextra'smcp[cli]>=2.0.0floor. The committeduv.lockitself still installs cleanly via--frozen(confirmed above), so this doesn't block CI today, but a freshuv lockwill fail until one of those two extras' version constraints is relaxed. Flagging since it's a live, unrelated supply-chain fragility — out of scope for this PR.🤖 Generated with Claude Code
https://claude.ai/code/session_01QyJoCc6YtjnErv6HKa6NPu