From 4cc3ffce8ba6f2b7a12f0e48a4e3ec67a7672084 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 9 Aug 2026 08:03:05 +0000 Subject: [PATCH 1/2] ci: add Strix AI penetration testing workflow Wire up headless Strix scans on pull requests and manual dispatch so Chronos can be security-tested with validated findings and SARIF upload. Requires STRIX_LLM and LLM_API_KEY repository secrets. Co-authored-by: Saim --- .github/workflows/strix-security.yml | 75 ++++++++++++++++++++++++++++ .gitignore | 3 ++ 2 files changed, 78 insertions(+) create mode 100644 .github/workflows/strix-security.yml diff --git a/.github/workflows/strix-security.yml b/.github/workflows/strix-security.yml new file mode 100644 index 00000000..83ae724c --- /dev/null +++ b/.github/workflows/strix-security.yml @@ -0,0 +1,75 @@ +name: Strix Security Scan + +on: + pull_request: + workflow_dispatch: + +jobs: + strix-scan: + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + actions: read + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Require Strix secrets + env: + STRIX_LLM: ${{ secrets.STRIX_LLM }} + LLM_API_KEY: ${{ secrets.LLM_API_KEY }} + run: | + if [ -z "$STRIX_LLM" ] || [ -z "$LLM_API_KEY" ]; then + echo "::error::Missing repository secrets STRIX_LLM and/or LLM_API_KEY." + echo "Add them under Settings → Secrets and variables → Actions, then re-run." + echo "Example STRIX_LLM value: openai/gpt-5.4" + exit 1 + fi + + - name: Install Strix + run: curl -sSL https://strix.ai/install | bash + + - name: Run Strix (quick, PR diff-scoped) + env: + STRIX_LLM: ${{ secrets.STRIX_LLM }} + LLM_API_KEY: ${{ secrets.LLM_API_KEY }} + run: | + export PATH="$HOME/.strix/bin:$PATH" + BASE_REF="${{ github.base_ref }}" + if [ -z "$BASE_REF" ]; then + BASE_REF="main" + fi + strix -n -t ./ \ + --scan-mode quick \ + --scope-mode auto \ + --diff-base "origin/${BASE_REF}" \ + --max-budget 10 \ + --instruction "White-box security review of Chronos (Node.js/TypeScript DST framework). Focus on supply-chain risks, unsafe deserialization of Trace/capsule JSON, CLI command injection, path traversal in inspector/trace loading, prototype pollution, and accidental entropy/network exposure. Do not attack third-party systems." + + - name: Fail unless the scan completed + if: always() && hashFiles('strix_runs/**/run.json') != '' + run: | + run_json=$(ls -t strix_runs/*/run.json | head -1) + status=$(jq -r .status "$run_json") + echo "Strix run status: $status" + if [ "$status" != "completed" ]; then + echo "Strix run status is '$status' — scan did not complete (likely budget exhausted)." >&2 + exit 1 + fi + + - name: Upload SARIF + if: always() + continue-on-error: true + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: strix_runs + + - name: Upload Strix artifacts + if: always() + uses: actions/upload-artifact@v4 + with: + name: strix-scan-results + path: strix_runs/ + if-no-files-found: ignore diff --git a/.gitignore b/.gitignore index 576c5222..3292bd27 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,6 @@ config.js .env.*.local .github-pages/ + +# Strix scan artifacts +strix_runs/ From 11c5fff3752086798b30a77bf7b0e67ff6fc5d5a Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 9 Aug 2026 08:22:24 +0000 Subject: [PATCH 2/2] ci: skip Strix scan gracefully when secrets are missing Avoid failing PR checks before STRIX_LLM and LLM_API_KEY are configured. Co-authored-by: Saim --- .github/workflows/strix-security.yml | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/workflows/strix-security.yml b/.github/workflows/strix-security.yml index 83ae724c..e0e15d30 100644 --- a/.github/workflows/strix-security.yml +++ b/.github/workflows/strix-security.yml @@ -16,22 +16,26 @@ jobs: with: fetch-depth: 0 - - name: Require Strix secrets + - name: Check Strix secrets + id: secrets env: STRIX_LLM: ${{ secrets.STRIX_LLM }} LLM_API_KEY: ${{ secrets.LLM_API_KEY }} run: | if [ -z "$STRIX_LLM" ] || [ -z "$LLM_API_KEY" ]; then - echo "::error::Missing repository secrets STRIX_LLM and/or LLM_API_KEY." - echo "Add them under Settings → Secrets and variables → Actions, then re-run." - echo "Example STRIX_LLM value: openai/gpt-5.4" - exit 1 + echo "configured=false" >> "$GITHUB_OUTPUT" + echo "::notice::Skipping Strix scan — add repository secrets STRIX_LLM and LLM_API_KEY, then re-run." + echo "Example STRIX_LLM: openai/gpt-5.4" + else + echo "configured=true" >> "$GITHUB_OUTPUT" fi - name: Install Strix + if: steps.secrets.outputs.configured == 'true' run: curl -sSL https://strix.ai/install | bash - name: Run Strix (quick, PR diff-scoped) + if: steps.secrets.outputs.configured == 'true' env: STRIX_LLM: ${{ secrets.STRIX_LLM }} LLM_API_KEY: ${{ secrets.LLM_API_KEY }} @@ -49,7 +53,7 @@ jobs: --instruction "White-box security review of Chronos (Node.js/TypeScript DST framework). Focus on supply-chain risks, unsafe deserialization of Trace/capsule JSON, CLI command injection, path traversal in inspector/trace loading, prototype pollution, and accidental entropy/network exposure. Do not attack third-party systems." - name: Fail unless the scan completed - if: always() && hashFiles('strix_runs/**/run.json') != '' + if: steps.secrets.outputs.configured == 'true' run: | run_json=$(ls -t strix_runs/*/run.json | head -1) status=$(jq -r .status "$run_json") @@ -60,16 +64,16 @@ jobs: fi - name: Upload SARIF - if: always() + if: steps.secrets.outputs.configured == 'true' continue-on-error: true uses: github/codeql-action/upload-sarif@v3 with: sarif_file: strix_runs - name: Upload Strix artifacts - if: always() + if: steps.secrets.outputs.configured == 'true' uses: actions/upload-artifact@v4 with: name: strix-scan-results path: strix_runs/ - if-no-files-found: ignore + if-no-files-found: ignore \ No newline at end of file