chore(ci): pin actions, add cooldown, security policy, lean dist - #203
Merged
Conversation
Plumb's package audit fails four checks, holding the composite at 66.04 (security 48.65, maintenance 80.95). All four are fixed here: security.actions-sha-pinned 0 of 14 refs pinned (weight 8) security.dependency-update-cooldown no cooldown config (weight 4) security.security-policy-present no SECURITY.md (weight 3) maintenance.composer-lock-policy lock in dist archive (weight 2) It also lifts dependabot-or-renovate-configured from warn to pass: the updater only covered github-actions while composer.json and two package-lock.json files were in use, and lean-dist from warn to pass by dropping phpstan.neon from the archive. Tag refs are mutable: a compromised maintainer can re-point v7 at arbitrary code, as tj-actions/changed-files did in March 2025. Every third-party action is now pinned to a full 40-character commit SHA with the resolved version in a trailing comment, which is what Dependabot reads to keep the pins current. zizmor 1.29.0 additionally reported 5 high findings, all fixed: pull_request_target in auto-merge.yml, the spoofable github.actor bot check, workflow-wide contents: write in release.yml, secrets: inherit into a reusable workflow that reads no secrets, and four run blocks interpolating github.ref_name directly. auto-merge.yml now follows GitHub's documented pattern, which laravel/framework also runs. A CI job fails on any unpinned third-party ref so this cannot silently regress, and zizmor runs on workflow changes via zizmorcore/zizmor-action.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Takes the package from 66.04 to 100 on Plumb, the audit behind the Filament plugin directory badge. Same treatment as relaticle/flowforge#168 and #169.
Plumb checks
security.actions-sha-pinnedsecurity.dependency-update-cooldownsecurity.security-policy-presentsecurity.dependabot-or-renovate-configuredmaintenance.composer-lock-policymaintenance.lean-distSecurity 48.65 to 100, Maintenance 80.95 to 100. Composite is
0.55*security + 0.30*maintenance + 0.15*ecosystem, a formula I derived and validated to the second decimal against four scanned packages, so 66.04 to 100.00.The two
warnstates are worth calling out because they are not visible as failures on the plugin page. The updater only coveredgithub-actionswhilecomposer.jsonand twopackage-lock.jsonfiles were in use, so it now covers composer, npm at root, and npm in/docs.lean-distwas dropping half credit for shippingphpstan.neon.Pins
14 refs resolved through the GitHub API, each SHA cross-checked against the tag object it dereferences to.
actions/checkoutandshivammathur/setup-phpmatch byte-for-byte whatbezhanSalleh/filament-shieldships.The trailing version comments are load-bearing: Dependabot reads them to know the current version, so
auto-merge.ymlkeeps classifying updates correctly after pinning.zizmor
zizmor 1.29.0reported 5 high findings on the workflows. All fixed:dangerous-triggersauto-merge.ymlpull_request_targettopull_requestbot-conditionsauto-merge.ymlgithub.actortogithub.event.pull_request.user.loginexcessive-permissionsrelease.ymlcontents: writemoved from workflow level to the two jobs that need itsecrets-inheritrelease.ymltests.ymlreads no secretstemplate-injectionx4release.ymlgithub.ref_nameandgithub.repositorypassed viaenv:instead of interpolated intorunauto-merge.ymlnow matches GitHub's documented pattern:on: pull_requestwith permissions elevated per job. Dependabot-triggeredpull_requestruns get a read-only token by default, which is why permissions are declared on the job.laravel/frameworkruns this exact shape in production.Regression guards
actions-pinnedjob intests.ymlfails on any third-partyuses:lacking a 40-hex SHA.release.ymlcallstests.ymlviaworkflow_call, so releases are gated on it.zizmor.yml, path-filtered to.github/**, results to the Security tab. Advisory by design; the hard gate stays the pin job.Verification
dependabot.ymlparse as YAML.zizmor --min-severity medium .github/reportsNo findings to report.git archive HEADconfirmed:composer.lock,phpstan.neon,.github/anddocs/are all absent from the dist archive.Note on when the score moves
Plumb scores the latest release tag, not branch HEAD. Confirmed on packages where the two differ (
spatie/laravel-permissionis scored at tag8.3.0whilemainsits elsewhere). Merging alone will not move the badge; it needs a tag, then Plumb rescans on its 24h cadence.