From ebc9dc4fa383c52936047fb4e98197469506ffe9 Mon Sep 17 00:00:00 2001 From: Cliff Colvin Date: Thu, 9 Jul 2026 13:29:17 -0500 Subject: [PATCH 1/6] security: OpenSSF Scorecard Stage 1 hardening Address three low-risk, additive Scorecard findings: - Dependency-Update-Tool: add .github/dependabot.yml covering the github-actions and gomod ecosystems (weekly). Also keeps pinned action SHAs current for later hardening stages. - Security-Policy: add SECURITY.md with a private vulnerability reporting contact, disclosure policy, and supported-versions info. - Token-Permissions: update-go-version.yaml declared top-level contents: write. Scope it to read at the top level and move contents/pull-requests: write down to the job that commits and opens the PR. Co-Authored-By: Claude Fable 5 Signed-off-by: Cliff Colvin --- .github/dependabot.yml | 17 +++++++++++++ .github/workflows/update-go-version.yaml | 6 +++-- SECURITY.md | 31 ++++++++++++++++++++++++ 3 files changed, 52 insertions(+), 2 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 SECURITY.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..670a0ca --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,17 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + labels: + - "dependencies" + - "github-actions" + + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "weekly" + labels: + - "dependencies" + - "go" diff --git a/.github/workflows/update-go-version.yaml b/.github/workflows/update-go-version.yaml index 8f65e6e..d552211 100644 --- a/.github/workflows/update-go-version.yaml +++ b/.github/workflows/update-go-version.yaml @@ -6,13 +6,15 @@ on: workflow_dispatch: permissions: - contents: write - pull-requests: write + contents: read jobs: check-and-update-go: name: Check and update Go version runs-on: ubuntu-latest + permissions: + contents: write # commit the go.mod/go.sum version bump + pull-requests: write # open the automated update PR steps: - name: Checkout repository uses: actions/checkout@v6.0.2 diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..8c2b47b --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,31 @@ +# bingen Security Policy + +The bingen project greatly appreciates the need for security and timely updates. bingen is a code-generation tool maintained under the [OpenCost](https://github.com/opencost) organization, and generated code flows into projects that sit close to cloud billing data, so we take security seriously. We are very grateful to the users, security researchers, and developers who report security vulnerabilities to us. All reported security vulnerabilities will be carefully assessed, addressed, and responded to. + +## Code Security + +Application code is version controlled using GitHub. All code changes are tracked with full revision history and are attributable to a specific individual. Code must be reviewed and accepted by a different engineer than the author of the change. + +### Dependabot + +bingen has [Dependabot](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-supply-chain-security#what-is-dependabot) enabled for assessing dependencies in the project, covering both the `gomod` and `github-actions` ecosystems. + +## Supported Versions + +bingen provides security updates for the most recent release on GitHub. Security fixes are applied to `main` and included in the next tagged release. + +## Reporting a Vulnerability + +The bingen project has enabled [Private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability), which allows for direct, confidential reporting of security issues to the maintainers. To report a vulnerability, open a private report from the **Security** tab of the [bingen repository](https://github.com/opencost/bingen/security/advisories/new). + +Please include a thorough description of the issue, the steps you took to reproduce it, affected versions, and, if known, any mitigations. The maintainers will help diagnose the severity of the issue and determine how to address it. We aim to acknowledge new reports within 3 business days. Issues deemed to be non-critical will be filed as GitHub issues. Critical issues will receive immediate attention and be fixed as quickly as possible. + +## Disclosure policy + +For known public security vulnerabilities, we will disclose the vulnerability as soon as possible after receiving the report. Vulnerabilities discovered for the first time will be disclosed in accordance with the following process: + +1. The received security vulnerability report is handed to the maintainers for follow-up coordination and repair work. +2. After the vulnerability is confirmed, we create a draft GitHub Security Advisory that lists the details of the vulnerability. +3. Related personnel are invited to discuss the fix. +4. A temporary private fork is used to collaborate on a fix. +5. After the fixed code is merged, the vulnerability is publicly posted in the GitHub Advisory Database. From b25dbc3b2a73ae95fb425b697c35c9b4efe43b41 Mon Sep 17 00:00:00 2001 From: Cliff Colvin Date: Thu, 9 Jul 2026 13:29:17 -0500 Subject: [PATCH 2/6] security: align dependabot.yml with opencost conventions Match the OpenCost org's dependabot style (commented sections, no custom labels). Single gomod directory since bingen is a single module, plus the github-actions ecosystem. Co-Authored-By: Claude Fable 5 Signed-off-by: Cliff Colvin --- .github/dependabot.yml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 670a0ca..ec4614a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,17 +1,13 @@ version: 2 updates: - - package-ecosystem: "github-actions" - directory: "/" + # Dependencies listed in go.mod + - package-ecosystem: "gomod" + directory: "/" # Location of package manifests schedule: interval: "weekly" - labels: - - "dependencies" - - "github-actions" - - package-ecosystem: "gomod" + # Dependencies listed in .github/workflows/*.yaml + - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" - labels: - - "dependencies" - - "go" From 1f3ab48785b6a87cefba66ce61b3b0b8d6f94fc3 Mon Sep 17 00:00:00 2001 From: Cliff Colvin Date: Thu, 9 Jul 2026 13:27:57 -0500 Subject: [PATCH 3/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Cliff Colvin --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 8c2b47b..f25354e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -16,7 +16,7 @@ bingen provides security updates for the most recent release on GitHub. Security ## Reporting a Vulnerability -The bingen project has enabled [Private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability), which allows for direct, confidential reporting of security issues to the maintainers. To report a vulnerability, open a private report from the **Security** tab of the [bingen repository](https://github.com/opencost/bingen/security/advisories/new). +The bingen project supports GitHub [Private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability), which allows for direct, confidential reporting of security issues to the maintainers. If private reporting is enabled, open a private report from the **Security** tab of the [bingen repository](https://github.com/opencost/bingen/security/advisories/new). Please include a thorough description of the issue, the steps you took to reproduce it, affected versions, and, if known, any mitigations. The maintainers will help diagnose the severity of the issue and determine how to address it. We aim to acknowledge new reports within 3 business days. Issues deemed to be non-critical will be filed as GitHub issues. Critical issues will receive immediate attention and be fixed as quickly as possible. From 32900584712e337b54c59ce2b6b725394444d3c0 Mon Sep 17 00:00:00 2001 From: Cliff Colvin Date: Thu, 9 Jul 2026 13:33:13 -0500 Subject: [PATCH 4/6] security: pin all GitHub Actions to full-length commit SHAs Scorecard Pinned-Dependencies (Stage 2a). Pin every unpinned `uses:` reference to a full-length commit SHA, keeping the human-readable version tag in a trailing comment. Covers build-test, codecs-check, codeql, format-check, golangci-lint, scorecard, sonar, update-go-version, and vulnerability-scan. The Dependabot github-actions config added in this branch keeps these SHAs current so pinning does not rot. Co-Authored-By: Claude Fable 5 Signed-off-by: Cliff Colvin --- .github/workflows/build-test.yaml | 8 ++++---- .github/workflows/codecs-check.yaml | 6 +++--- .github/workflows/codeql.yaml | 8 ++++---- .github/workflows/format-check.yaml | 4 ++-- .github/workflows/golangci-lint.yaml | 6 +++--- .github/workflows/scorecard.yml | 2 +- .github/workflows/sonar.yaml | 4 ++-- .github/workflows/update-go-version.yaml | 6 +++--- .github/workflows/vulnerability-scan.yaml | 2 +- 9 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml index 7bf8dbe..8e8a783 100644 --- a/.github/workflows/build-test.yaml +++ b/.github/workflows/build-test.yaml @@ -17,15 +17,15 @@ jobs: backend: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: "stable" - name: Go mod cache - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: | ~/.cache/go-build @@ -48,7 +48,7 @@ jobs: echo "${GITHUB_HEAD_REF}" > head.txt - name: Upload coverage artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: code-coverage path: | diff --git a/.github/workflows/codecs-check.yaml b/.github/workflows/codecs-check.yaml index 4a18572..3b8b8d5 100644 --- a/.github/workflows/codecs-check.yaml +++ b/.github/workflows/codecs-check.yaml @@ -18,15 +18,15 @@ jobs: name: Verify generated codecs are committed runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: "stable" - name: Go mod cache - uses: actions/cache@v5 + uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 with: path: | ~/.cache/go-build diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 254eb3c..a1180d7 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -26,18 +26,18 @@ jobs: language: ["go"] steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4 with: languages: ${{ matrix.language }} - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4 - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4 with: # Run the analysis purely for in-PR feedback / job-level pass-fail; # do not upload SARIF results to the GitHub Security tab. The diff --git a/.github/workflows/format-check.yaml b/.github/workflows/format-check.yaml index 67d1af7..831fade 100644 --- a/.github/workflows/format-check.yaml +++ b/.github/workflows/format-check.yaml @@ -14,9 +14,9 @@ jobs: format-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod - name: Check formatting diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml index 73c795f..5e31022 100644 --- a/.github/workflows/golangci-lint.yaml +++ b/.github/workflows/golangci-lint.yaml @@ -16,11 +16,11 @@ jobs: name: lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.2 - - uses: actions/setup-go@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version-file: go.mod - name: golangci-lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9 with: version: v2.9.0 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 9e91d69..ee53584 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -46,6 +46,6 @@ jobs: retention-days: 5 - name: Upload to code scanning - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4 with: sarif_file: results.sarif diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml index c74df08..ba95a88 100644 --- a/.github/workflows/sonar.yaml +++ b/.github/workflows/sonar.yaml @@ -16,13 +16,13 @@ jobs: if: github.event.workflow_run.conclusion == 'success' steps: - name: Checkout repository at tested SHA - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.event.workflow_run.head_sha }} fetch-depth: 0 - name: Download coverage artifacts - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: code-coverage run-id: ${{ github.event.workflow_run.id }} diff --git a/.github/workflows/update-go-version.yaml b/.github/workflows/update-go-version.yaml index d552211..a2bc72b 100644 --- a/.github/workflows/update-go-version.yaml +++ b/.github/workflows/update-go-version.yaml @@ -17,10 +17,10 @@ jobs: pull-requests: write # open the automated update PR steps: - name: Checkout repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Setup Go - uses: actions/setup-go@v6 + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 with: go-version: stable @@ -103,7 +103,7 @@ jobs: - name: Create pull request if: steps.check-existing-prs.outputs.skip_update == 'false' && steps.version-check.outputs.update_needed == 'true' && steps.changes.outputs.skip_pr == 'false' - uses: peter-evans/create-pull-request@v7 + uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7 with: token: ${{ secrets.GITHUB_TOKEN }} commit-message: "chore: update Go version to ${{ steps.version-check.outputs.new_version }}" diff --git a/.github/workflows/vulnerability-scan.yaml b/.github/workflows/vulnerability-scan.yaml index 01029c8..ab9d1b2 100644 --- a/.github/workflows/vulnerability-scan.yaml +++ b/.github/workflows/vulnerability-scan.yaml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Run Trivy vulnerability scanner id: trivy-scan From 36be2dda720a40a16c34ac1777ef79e49fd3b0c6 Mon Sep 17 00:00:00 2001 From: Cliff Colvin Date: Thu, 9 Jul 2026 17:32:26 -0500 Subject: [PATCH 5/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Cliff Colvin --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index f25354e..c5dca34 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -20,7 +20,7 @@ The bingen project supports GitHub [Private vulnerability reporting](https://doc Please include a thorough description of the issue, the steps you took to reproduce it, affected versions, and, if known, any mitigations. The maintainers will help diagnose the severity of the issue and determine how to address it. We aim to acknowledge new reports within 3 business days. Issues deemed to be non-critical will be filed as GitHub issues. Critical issues will receive immediate attention and be fixed as quickly as possible. -## Disclosure policy +## Disclosure Policy For known public security vulnerabilities, we will disclose the vulnerability as soon as possible after receiving the report. Vulnerabilities discovered for the first time will be disclosed in accordance with the following process: From 963776eef54327d36dae1ed860bd284b26f81ac7 Mon Sep 17 00:00:00 2001 From: Cliff Colvin Date: Thu, 9 Jul 2026 18:28:12 -0500 Subject: [PATCH 6/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Cliff Colvin --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index c5dca34..e365a59 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -24,7 +24,7 @@ Please include a thorough description of the issue, the steps you took to reprod For known public security vulnerabilities, we will disclose the vulnerability as soon as possible after receiving the report. Vulnerabilities discovered for the first time will be disclosed in accordance with the following process: -1. The received security vulnerability report is handed to the maintainers for follow-up coordination and repair work. +1. Each security vulnerability report is triaged by the maintainers for follow-up coordination and remediation work. 2. After the vulnerability is confirmed, we create a draft GitHub Security Advisory that lists the details of the vulnerability. 3. Related personnel are invited to discuss the fix. 4. A temporary private fork is used to collaborate on a fix.