fix(lanes): green security-scan, a11y, SAST, scorecard, and trunk-check lanes #717
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| # actionlint configuration | ||
| # https://github.com/rhysd/actionlint/blob/v1.7.12/docs/config.md | ||
| # Note: the repository self-hosts no runners; all workflows run on GitHub-hosted | ||
| # images, so no self-hosted-runner labels are declared here. | ||
|
|
||
| paths: | ||
| # Forward reference: the `detect` job's `outputs:` block references | ||
| # `steps.detect.outputs.*` before the step with `id: detect` is declared. | ||
| # This is legal in GitHub Actions (step ids resolve within the whole job) and | ||
| # the detect job is exercised on every CI run, but actionlint's static | ||
| # analysis reports it as an undefined property. Ignore that specific message. | ||
| .github/workflows/ci.yml: | ||
| ignore: | ||
| - 'property "detect" is not defined in object type' |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,13 +4,18 @@ on: | |
| branches: [main, develop] | ||
| pull_request: | ||
| schedule: [{cron: "0 2 * * *"}] | ||
| permissions: | ||
| contents: read | ||
| security-events: write | ||
| jobs: | ||
| codeql: | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - uses: github/codeql-action/init@v4 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
git ls-remote https://github.com/github/codeql-action.git \
'refs/tags/v4' 'refs/tags/v4^{}'Repository: KooshaPari/sharecli Length of output: 268 🌐 Web query:
💡 Result: The GitHub CodeQL Action v4 is the current, recommended major version of the action [1][2][3]. GitHub advises users to reference the CodeQL Action using the major version tag, such as v4, in workflow files [1][2][3]. This practice ensures that workflows automatically receive the latest releases, bug fixes, features, and updated CodeQL CLI versions within that major version [1][2][3]. As of August 9, 2026, the latest releases within the v4 series include versions such as v4.37.4 [4][5]. The CodeQL Action v4 was introduced on October 7, 2025, and runs on the Node.js 24 runtime [6]. To use the action in your GitHub Actions workflow, you would reference it as follows [7]: - uses: github/codeql-action/init@v4 - uses: github/codeql-action/analyze@v4 Major version tags like v4 act as moving targets that point to the most recent release within that branch, allowing for automatic updates without manual intervention [1][2][3]. Detailed information on specific changes and version history can be found on the official GitHub CodeQL Action releases page [4][5]. Citations:
Pin the CodeQL init action to an immutable commit.
🧰 Tools🪛 zizmor (1.29.0)[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| with: | ||
| # Go was removed: the repo contains no Go sources, and CodeQL aborts | ||
| # database finalization when a configured language has no files. | ||
| languages: typescript, python, rust | ||
| - uses: github/codeql-action/autobuild@v4 | ||
| - uses: github/codeql-action/analyze@v4 | ||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -15,7 +15,12 @@ on: | |||||||||||||||||||||||||||
| push: | ||||||||||||||||||||||||||||
| branches: [main] | ||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| permissions: | ||||||||||||||||||||||||||||
| contents: read | ||||||||||||||||||||||||||||
| # Required by scorecard-action's `publish_results` (Fulcio signing via OIDC); | ||||||||||||||||||||||||||||
| # `read-all` (previous value) blocked the token and failed the run with | ||||||||||||||||||||||||||||
| # "error obtaining token: expired_token" during result signing. | ||||||||||||||||||||||||||||
| id-token: write | ||||||||||||||||||||||||||||
|
Comment on lines
+18
to
+23
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
rg -n -C3 'permissions:|security-events|upload-sarif|sarif_file' \
.github/workflows/scorecard.ymlRepository: KooshaPari/sharecli Length of output: 753 🌐 Web query:
💡 Result: To use the github/codeql-action/upload-sarif action, your workflow job requires specific permissions granted to the GITHUB_TOKEN. While security-events: write is the fundamental permission for uploading analysis results, technical requirements for the action have evolved to include additional access for certain environments [1][2]. The required permissions are: 1. security-events: write: This is mandatory for all workflows to allow the action to upload SARIF results to GitHub Code Scanning [3][4][5]. 2. contents: read: This is required for workflows running in private repositories [3][4][5]. 3. actions: read: This is required, particularly in private repositories, because the action needs to query workflow run metadata to function correctly [1][2]. Failure to include this may result in a "Resource not accessible by integration" error [6][2]. For a typical workflow job in a private repository, you should configure the permissions block as follows [3][4]: permissions: security-events: write actions: read contents: read If you do not explicitly define these permissions in your workflow file, the GITHUB_TOKEN may default to a set of permissions that lacks the necessary access, leading to integration errors [6][2]. Always define these at the job level to ensure the action operates with the required privileges [6][2]. Citations:
Grant the SARIF upload permission. This workflow uploads Proposed fix permissions:
contents: read
+ security-events: write
# Required by scorecard-action's `publish_results` (Fulcio signing via OIDC);
id-token: write📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.29.0)[error] 23-23: overly broad permissions (excessive-permissions): id-token: write is overly broad at the workflow level (excessive-permissions) [warning] 23-23: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment (undocumented-permissions) 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||
| analysis: | ||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| # Yamllint configuration used by Trunk Check (docs: https://yamllint.readthedocs.io/) | ||
| # Relaxations vs yamllint defaults: | ||
| # - line-length: the repo's workflows/docs carry long URLs and expressions | ||
| # (GitHub `${{ }}` interpolations, SHA-pinned action refs). Enforced for | ||
| # `.md`-free YAML would generate noise; disabled repo-wide. | ||
| # - comments: hash comments (e.g. `# v7.0.1` next to pinned actions) may be | ||
| # indented freely; only require a space after the hash. | ||
| # - document-start: workflows start with `name:` and no `---`; not required. | ||
| # - truthy: `on:` is parsed as a boolean key by some YAML 1.1 parsers. | ||
| # Allowed explicitly to keep `on:`-based workflow triggers clean. | ||
|
|
||
| extends: default | ||
|
|
||
| rules: | ||
| line-length: disable | ||
| comments: | ||
| require-starting-space: true | ||
| min-spaces-from-content: 1 | ||
| comments-indentation: disable | ||
| document-start: disable | ||
| truthy: | ||
| allowed-values: | ||
| - "true" | ||
| - "false" | ||
| - "on" | ||
| - "off" | ||
| check-keys: false | ||
| brackets: | ||
| max-spaces-inside: 1 | ||
| braces: | ||
| min-spaces-inside: 0 | ||
| max-spaces-inside: 1 | ||
| indentation: | ||
| spaces: consistent | ||
| indent-sequences: whatever |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,113 +1,49 @@ | ||
| # ============================================================================= | ||
| # Trunk.io — Unified linting/formatting in GitHub Actions | ||
|
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win Replace the Unicode em dash with ASCII punctuation. Replace 🤖 Prompt for AI AgentsSource: Coding guidelines |
||
| # ============================================================================= | ||
| # Schema: https://docs.trunk.io/check/reference | ||
| # | ||
| # Scope note: this lane is deliberately lean. The repo's heavier quality gates | ||
| # already run as dedicated workflows (cargo fmt + clippy in security.yml / | ||
| # ci-gate.yml, cargo test in the release matrix), and the nested lib/teamcomm | ||
| # workspace is not formatted by the root `cargo fmt` (40+ files). This lane | ||
| # lints the things no other lane covers: workflow YAML (actionlint), TOML | ||
| # formatting (taplo), and YAML style (yamllint, relaxed via | ||
| # .trunk/configs/.yamllint.yaml). | ||
| # ============================================================================= | ||
| version: 0.1 | ||
|
|
||
| plugins: | ||
| sources: | ||
| - id: trunk | ||
| uri: https://github.com/trunk-io/plugins | ||
| ref: v1.6.7 | ||
|
|
||
| cli: | ||
| version: 1.22.2 | ||
|
|
||
| lint: | ||
| enabled: | ||
| - actionlint | ||
| - taplo | ||
| - yamllint | ||
| disabled: [] | ||
| # The `detect` job's `outputs:` block references `steps.detect.outputs.*` | ||
| # before the step with `id: detect` is declared. This is legal in GitHub | ||
| # Actions (step ids resolve within the whole job; the detect job runs on | ||
| # every CI run), but actionlint's static analysis reports it as an undefined | ||
| # property. Ignore that specific message in ci.yml only. | ||
| ignore: | ||
| - linters: [actionlint] | ||
| paths: | ||
| - .github/workflows/ci.yml | ||
|
|
||
|
Comment on lines
+31
to
40
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' 'Trunk suppression:'
sed -n '25,42p' .trunk/trunk.yaml
printf '%s\n' 'Message-specific actionlint suppression:'
sed -n '6,15p' .github/actionlint.yamlRepository: KooshaPari/sharecli Length of output: 1251 Remove the broad Trunk
🤖 Prompt for AI Agents |
||
| actions: | ||
| enabled: [] | ||
| disabled: | ||
| - trunk-announce | ||
| - trunk-cache-prune | ||
| - trunk-upgrade-available | ||
|
|
||
| tools: | ||
| enabled: [] | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: KooshaPari/sharecli
Length of output: 3140
🏁 Script executed:
Repository: KooshaPari/sharecli
Length of output: 1142
Disable persisted checkout credentials.
actions/checkoutleavesGITHUB_TOKENconfigured in the local git config by default, so the repository-controlled CodeQL autobuild step can run with that token available. Setpersist-credentials: false.Proposed fix
📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 14-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents