Skip to content

chore(ci): pin actions, add cooldown, security policy, lean dist - #203

Merged
ManukMinasyan merged 1 commit into
3.xfrom
chore/harden-ci
Aug 19, 2026
Merged

chore(ci): pin actions, add cooldown, security policy, lean dist#203
ManukMinasyan merged 1 commit into
3.xfrom
chore/harden-ci

Conversation

@ManukMinasyan

Copy link
Copy Markdown
Collaborator

Takes the package from 66.04 to 100 on Plumb, the audit behind the Filament plugin directory badge. Same treatment as relaticle/flowforge#168 and #169.

Plumb checks

Check Weight Before After
security.actions-sha-pinned 8 fail, 0 of 14 pinned pass, 17 of 17
security.dependency-update-cooldown 4 fail, no cooldown pass, 7 days
security.security-policy-present 3 fail pass
security.dependabot-or-renovate-configured 5 warn (0.2) pass
maintenance.composer-lock-policy 2 fail, lock in dist pass
maintenance.lean-dist 4 warn (0.5) pass

Security 48.65 to 100, Maintenance 80.95 to 100. Composite is 0.55*security + 0.30*maintenance + 0.15*ecosystem, a formula I derived and validated to the second decimal against four scanned packages, so 66.04 to 100.00.

The two warn states are worth calling out because they are not visible as failures on the plugin page. The updater only covered github-actions while composer.json and two package-lock.json files were in use, so it now covers composer, npm at root, and npm in /docs. lean-dist was dropping half credit for shipping phpstan.neon.

Pins

14 refs resolved through the GitHub API, each SHA cross-checked against the tag object it dereferences to. actions/checkout and shivammathur/setup-php match byte-for-byte what bezhanSalleh/filament-shield ships.

The trailing version comments are load-bearing: Dependabot reads them to know the current version, so auto-merge.yml keeps classifying updates correctly after pinning.

zizmor

zizmor 1.29.0 reported 5 high findings on the workflows. All fixed:

Rule Where Fix
dangerous-triggers auto-merge.yml pull_request_target to pull_request
bot-conditions auto-merge.yml github.actor to github.event.pull_request.user.login
excessive-permissions release.yml contents: write moved from workflow level to the two jobs that need it
secrets-inherit release.yml dropped; tests.yml reads no secrets
template-injection x4 release.yml github.ref_name and github.repository passed via env: instead of interpolated into run

auto-merge.yml now matches GitHub's documented pattern: on: pull_request with permissions elevated per job. Dependabot-triggered pull_request runs get a read-only token by default, which is why permissions are declared on the job. laravel/framework runs this exact shape in production.

Regression guards

  • actions-pinned job in tests.yml fails on any third-party uses: lacking a 40-hex SHA. release.yml calls tests.yml via workflow_call, so releases are gated on it.
  • New zizmor.yml, path-filtered to .github/**, results to the Security tab. Advisory by design; the hard gate stays the pin job.

Verification

  • All 6 workflows and dependabot.yml parse as YAML.
  • 17 of 17 third-party refs on a 40-hex SHA, 1 first-party ref exempt.
  • zizmor --min-severity medium .github/ reports No findings to report.
  • git archive HEAD confirmed: composer.lock, phpstan.neon, .github/ and docs/ are all absent from the dist archive.

Note on when the score moves

Plumb scores the latest release tag, not branch HEAD. Confirmed on packages where the two differ (spatie/laravel-permission is scored at tag 8.3.0 while main sits elsewhere). Merging alone will not move the badge; it needs a tag, then Plumb rescans on its 24h cadence.

Plumb's package audit fails four checks, holding the composite at 66.04
(security 48.65, maintenance 80.95). All four are fixed here:

  security.actions-sha-pinned         0 of 14 refs pinned   (weight 8)
  security.dependency-update-cooldown no cooldown config    (weight 4)
  security.security-policy-present    no SECURITY.md        (weight 3)
  maintenance.composer-lock-policy    lock in dist archive  (weight 2)

It also lifts dependabot-or-renovate-configured from warn to pass: the
updater only covered github-actions while composer.json and two
package-lock.json files were in use, and lean-dist from warn to pass by
dropping phpstan.neon from the archive.

Tag refs are mutable: a compromised maintainer can re-point v7 at
arbitrary code, as tj-actions/changed-files did in March 2025. Every
third-party action is now pinned to a full 40-character commit SHA with
the resolved version in a trailing comment, which is what Dependabot
reads to keep the pins current.

zizmor 1.29.0 additionally reported 5 high findings, all fixed:
pull_request_target in auto-merge.yml, the spoofable github.actor bot
check, workflow-wide contents: write in release.yml, secrets: inherit
into a reusable workflow that reads no secrets, and four run blocks
interpolating github.ref_name directly. auto-merge.yml now follows
GitHub's documented pattern, which laravel/framework also runs.

A CI job fails on any unpinned third-party ref so this cannot silently
regress, and zizmor runs on workflow changes via zizmorcore/zizmor-action.
Copilot AI lite review requested due to automatic review settings August 19, 2026 14:39
@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@ManukMinasyan
ManukMinasyan merged commit 2a76adb into 3.x Aug 19, 2026
8 checks passed
@ManukMinasyan
ManukMinasyan deleted the chore/harden-ci branch August 19, 2026 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants