Skip to content

chore(BytePort): workflow hardening -- ubuntu-24.04, SHA pins #138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
KooshaPari wants to merge 7 commits into from
Closed

chore(BytePort): workflow hardening -- ubuntu-24.04, SHA pins #138

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c86afcf
ci: add permissions, timeouts, and SHA pins to workflow files
May 7, 2026
157e66c
ci: add permissions, timeout-minutes, SHA pinning to workflow files
May 7, 2026
79f662d
ci: fix duplicate keys and pin setup-go to v6.4.0 SHA in workflow files
May 7, 2026
3cb3f42
chore(byteport): remove tracked exe artifact from tmp/
May 7, 2026
d15cac1
fix(byteport): update workspace resolver to v3
May 7, 2026
e2edf8e
docs(byteport): refresh sladge badge on main
May 7, 2026
770ea7b
chore(BytePort): workflow hardening -- ubuntu-24.04, SHA pins
May 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions .github/workflows/cargo-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,16 @@ on:
- cron: '37 5 * * 3' # weekly Wednesday
workflow_dispatch:

permissions:
contents: read
actions: read
Copy link
Copy Markdown

@cursor cursor Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cargo audit missing checks: write permission breaks annotations

High Severity

The newly added top-level permissions block grants only contents: read and actions: read, but the rustsec/audit-check action requires checks: write to post check-run results and annotations via the GitHub API. Previously, no explicit permissions block existed, so the default token permissions (which include checks: write) applied. Now the action will fail with a "Resource not accessible by integration" error when it tries to create the check run.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 770ea7b. Configure here.


jobs:
audit:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998
with:
token: ${{ secrets.GITHUB_TOKEN }}
11 changes: 8 additions & 3 deletions .github/workflows/cargo-deny.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,15 +15,20 @@ on:
schedule:
- cron: '0 9 * * 1'

permissions:
contents: read
actions: read

jobs:
cargo-deny:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@stable
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # stable

- name: Run cargo-deny
uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb # v6
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/cargo-machete.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,14 @@ on:

permissions:
contents: read
actions: read

jobs:
detect-unused-dependencies:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

- uses: taiki-e/install-action@7769b73c2ec98c38dfcf2e18c83cfd4880c038c1
with:
Expand Down
10 changes: 8 additions & 2 deletions .github/workflows/cargo-semver-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,15 @@ concurrency:
on:
pull_request: { paths: ['**/Cargo.toml'] }
workflow_dispatch:

permissions:
contents: read
actions: read

jobs:
semver-checks:
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239
22 changes: 13 additions & 9 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,15 @@ on:
- main
pull_request:


permissions:
contents: read
actions: read

jobs:
vet:
name: Go Vet
runs-on: ubuntu-latest
timeout-minutes: 10
Copy link
Copy Markdown

@cursor cursor Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Vet job still uses ubuntu-latest runner

Low Severity

The vet job in ci.yml still uses runs-on: ubuntu-latest while the build and fmt jobs in the same file were converted to ubuntu-24.04. The PR description states "Replace ubuntu-latest with ubuntu-24.04 for reproducibility" and the test plan requires confirming no ubuntu-latest refs remain in workflows.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 770ea7b. Configure here.

permissions:
contents: read
strategy:
Expand All @@ -28,9 +30,9 @@ jobs:
- backend/nvms
steps:
- name: Checkout the code
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version-file: ${{ matrix.module }}/go.mod
cache-dependency-path: ${{ matrix.module }}/go.sum
Expand All @@ -40,7 +42,8 @@ jobs:

build:
name: Go Build
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 30
permissions:
contents: read
strategy:
Expand All @@ -51,9 +54,9 @@ jobs:
- backend/nvms
steps:
- name: Checkout the code
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version-file: ${{ matrix.module }}/go.mod
cache-dependency-path: ${{ matrix.module }}/go.sum
Expand All @@ -63,15 +66,16 @@ jobs:

fmt:
name: Go Fmt (advisory)
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
timeout-minutes: 10
continue-on-error: true
permissions:
contents: read
steps:
- name: Checkout the code
uses: actions/checkout@v4
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: 'stable'
- name: Check formatting
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,12 @@ on:
permissions:
contents: read
security-events: write
actions: read
jobs:
analyze:
timeout-minutes: 30
name: Analyze (${{ matrix.language }})
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
permissions:
security-events: write
contents: read
Expand All @@ -29,7 +31,7 @@ jobs:
matrix:
language: ["actions", "go", "javascript"]
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: github/codeql-action/init@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61
with:
languages: ${{ matrix.language }}
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/doc-links.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,11 @@ name: Doc Links
on: [push, pull_request]
permissions:
contents: read
actions: read
jobs:
links:
runs-on: ubuntu-latest
timeout-minutes: 10
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- run: echo "Doc link check (phenotype-tooling integration)"
4 changes: 3 additions & 1 deletion .github/workflows/fr-coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,11 @@ name: FR Coverage
on: [pull_request]
permissions:
contents: read
actions: read
jobs:
coverage:
runs-on: ubuntu-latest
timeout-minutes: 10
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- run: echo "FR coverage check (phenotype-tooling integration)"
4 changes: 3 additions & 1 deletion .github/workflows/go-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,13 @@ timeout-minutes: 45

permissions:
contents: read
actions: read

jobs:
go-build-test:
timeout-minutes: 30
name: Go build + test
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
permissions:
contents: read
defaults:
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/legacy-tooling-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,12 @@ on:

permissions:
contents: read
actions: read
jobs:
legacy-tooling-scan:
timeout-minutes: 10
name: Legacy Tooling Anti-Pattern Scan
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
permissions:
contents: read
security-events: write
Expand Down
7 changes: 6 additions & 1 deletion .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,13 @@
name: Lint
on: [push, pull_request]

permissions:
contents: read
actions: read
jobs:
golangci:
runs-on: ubuntu-latest
timeout-minutes: 10
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- uses: actions/setup-go@0a12ed9e1a4ce4b1a02a5f2dd1e3a9c9e6c7f8b1
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/quality-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,11 @@ name: Quality Gate
on: [push, pull_request]
permissions:
contents: read
actions: read
jobs:
gate:
runs-on: ubuntu-latest
timeout-minutes: 10
runs-on: ubuntu-24.04
continue-on-error: true
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/release-drafter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,12 @@ on:
types: [opened, reopened, synchronize]
workflow_dispatch:

permissions:
contents: read
actions: read
Comment on lines +10 to +12
Copy link
Copy Markdown

@codeant-ai codeant-ai Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Architect Review — CRITICAL

The Release Drafter workflow now sets the GITHUB_TOKEN to read-only (permissions: contents: read, actions: read) and does not override this at the job level, so the release-drafter step cannot create or update release drafts as intended.

Suggestion: Grant the update_release_draft job the minimal required write scope (e.g., permissions: { contents: write }), mirroring .github/workflows/release.yml:15-16, so the Release Drafter action can perform its release-draft mutations while keeping other workflows read-only.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.

**Path:** .github/workflows/release-drafter.yml
**Line:** 10:12
**Comment:**
	*CRITICAL: The Release Drafter workflow now sets the GITHUB_TOKEN to read-only (`permissions: contents: read, actions: read`) and does not override this at the job level, so the `release-drafter` step cannot create or update release drafts as intended.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

Copy link
Copy Markdown

@cursor cursor Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Release drafter permissions block breaks draft creation

High Severity

The newly added top-level permissions block grants only contents: read and actions: read, but the release-drafter action requires contents: write to create/update draft releases and pull-requests: read to categorize PRs. Since no job-level permissions override exists (unlike release.yml which correctly has a job-level contents: write), the token will lack write access and the action will silently fail to create draft releases.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 770ea7b. Configure here.

jobs:
update_release_draft:
timeout-minutes: 15
Copy link
Copy Markdown

@cursor cursor Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Release drafter still uses ubuntu-latest runner

Low Severity

The release-drafter.yml workflow still uses runs-on: ubuntu-latest despite other changes being made to this file (adding permissions and timeout-minutes). The PR's test plan explicitly requires confirming no ubuntu-latest refs remain in .github/workflows/.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 770ea7b. Configure here.

runs-on: ubuntu-latest
steps:
- uses: release-drafter/release-drafter@6a93d829887aa2e0748befe2e808c66c0ec6e4c7
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,13 @@ on:
tags:
- "v*"

permissions:
contents: read
actions: read
jobs:
release:
runs-on: ubuntu-latest
timeout-minutes: 15
runs-on: ubuntu-24.04
permissions:
contents: write
steps:
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/sbom-refresh.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,10 @@ on:

permissions:
contents: read
actions: read
jobs:
call-sbom-refresh:
timeout-minutes: 20
uses: KooshaPari/phenotype-tooling/.github/workflows/sbom-monthly.yml@79dff2b798fb8a3bc64237e4b2d054a08d3a4601
with:
repo_path: '.'
Expand Down
16 changes: 10 additions & 6 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
name: OpenSSF Scorecard
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

on:
branch_protection_rule:
timeout-minutes: 10
schedule:
- cron: '17 3 * * 6'
push:
Expand All @@ -11,31 +14,32 @@ permissions: read-all

jobs:
analysis:
timeout-minutes: 20
name: Scorecard analysis
runs-on: ubuntu-latest
runs-on: ubuntu-24.04
permissions:
security-events: write
id-token: write
contents: read
actions: read

steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false

- uses: ossf/scorecard-action@13ec8c77e8a5dae7e0a0d47bde3e3004df15d34f
- uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2 # v2.4.3
with:
results_file: results.sarif
results_format: sarif
publish_results: true

- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
with:
name: SARIF file
path: results.sarif
retention-days: 5

- uses: github/codeql-action/upload-sarif@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61
- uses: github/codeql-action/upload-sarif@ed410739ba306e4ebe5e123421a6bd694e494a2b # v4
with:
sarif_file: results.sarif
4 changes: 3 additions & 1 deletion .github/workflows/secrets-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,11 @@ on:

permissions:
contents: read
actions: read
jobs:
trufflehog:
runs-on: ubuntu-latest
timeout-minutes: 20
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/trufflehog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,13 @@ on:
pull_request:
branches: ["**"]

permissions:
contents: read
actions: read
jobs:
trufflehog:
runs-on: ubuntu-latest
timeout-minutes: 20
runs-on: ubuntu-24.04
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
Expand Down
2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
[workspace]
resolver = "2"
resolver = "3"
Copy link
Copy Markdown

@cursor cursor Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cargo resolver changed from "2" to "3" unexpectedly

Medium Severity

The workspace resolver was changed from "2" to "3", which enables MSRV-aware dependency resolution. This is a behavioral change unrelated to the PR's stated scope of workflow hardening. The sole workspace member (frontend/web/src-tauri) declares rust-version = "1.77.2", so resolver 3 may select different (potentially older) dependency versions to satisfy that constraint, potentially causing build failures or behavioral changes.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 770ea7b. Configure here.

members = [
"frontend/web/src-tauri",
]
Expand Down
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
[![Release](https://img.shields.io/github/v/release/KooshaPari/BytePort?include_prereleases&sort=semver)](https://github.com/KooshaPari/BytePort/releases)
[![License](https://img.shields.io/github/license/KooshaPari/BytePort)](LICENSE)
[![Phenotype](https://img.shields.io/badge/Phenotype-org-blueviolet)](https://github.com/KooshaPari)
[![AI Slop Inside](https://sladge.net/badge.svg)](https://sladge.net)


## What is this
Expand Down
2 changes: 0 additions & 2 deletions backend/byteport/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,7 @@ import (
"github.com/gin-contrib/cors"
"github.com/gin-gonic/gin"
"go.opentelemetry.io/otel"
"go.opentelemetry.io/otel/attribute"
"go.opentelemetry.io/otel/exporters/stdout/stdouttrace"
"go.opentelemetry.io/otel/sdk/resource"
"go.opentelemetry.io/otel/sdk/trace"
)

Expand Down
Binary file removed backend/byteport/tmp/main.exe~
View file
Open in desktop
Binary file not shown.
Loading
Loading