SREDevOps.org Agent 2f959e6afb fix(ci): harden workflow token scope and download integrity (#39) ...

Security audit of .github/workflows found a script-injection vector in the
release workflow, over-broad token grants on non-publishing jobs, and
downloaded tooling/manifests executed without integrity checks.

- release: pass the tag/dispatch input through env instead of interpolating
  it into the validation script; default workflow permissions to contents:read
- build-main/build-gateway: grant write scopes only to the build job
- _build-image/codeql: stop persisting checkout credentials
- ci/release: verify actionlint, hadolint and git-cliff against pinned SHA-256s
- ci-manifests/e2e: verify upstream CRD manifests against versions.env pins
- e2e: redact token material before uploading cluster diagnostics
- docs: add workflow-security.md with controls, audit record and residual
  repository-setting recommendations

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

2026-10-30 15:16:51 -03:00

3.8 KiB

Raw Permalink Blame History

View Raw