From c3fc39d9c1f53596a32a67d7d41eb7e611d5888f Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 15:13:51 -0400 Subject: [PATCH 1/7] Add zizmor and actionlint CI job for GitHub Actions auditing Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/build.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b1ba33d..892020d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -16,6 +16,23 @@ jobs: - name: Run rubocop run: | bundle exec rubocop --parallel + lint-actions: + name: GitHub Actions audit + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v6 + with: + persist-credentials: false + + - name: Run actionlint + uses: rhysd/actionlint@v1.7.11 + + - name: Run zizmor + uses: zizmorcore/zizmor-action@v0.5.2 + with: + advanced-security: false + tests: name: Tests runs-on: ubuntu-latest From 15e22dba47a6c5d3a1798c4efc908f5b6179734b Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 15:14:09 -0400 Subject: [PATCH 2/7] Configure dependabot for github-actions and bundler with batching and cooldowns Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/dependabot.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..60ab37f --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,23 @@ +version: 2 + +updates: + - package-ecosystem: github-actions + directory: "/" + groups: + github-actions: + patterns: + - "*" + schedule: + interval: weekly + cooldown: + default-days: 7 + + - package-ecosystem: bundler + directory: "/" + schedule: + interval: weekly + cooldown: + semver-major-days: 7 + semver-minor-days: 3 + semver-patch-days: 2 + default-days: 7 From ac8d246ef40696016d4b39e54b8c058e08791fee Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 15:14:30 -0400 Subject: [PATCH 3/7] Pin all GitHub Actions to SHA hashes Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/build.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 892020d..27d3ce0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -7,9 +7,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 - name: Setup Ruby and install gems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0 with: ruby-version: 3.0.2 bundler-cache: true @@ -21,15 +21,15 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Run actionlint - uses: rhysd/actionlint@v1.7.11 + uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11 - name: Run zizmor - uses: zizmorcore/zizmor-action@v0.5.2 + uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 with: advanced-security: false @@ -72,9 +72,9 @@ jobs: TARGET_DB: ${{ matrix.database }} steps: - name: Checkout code - uses: actions/checkout@v2 + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 - name: Setup Ruby and install gems - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0 with: ruby-version: ${{ matrix.ruby-version }} bundler-cache: true From c6083a59943bd61c998bc1b918cbe1f1f517145d Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 15:15:00 -0400 Subject: [PATCH 4/7] Suppress unpinned-images for redis service container Digest pinning for container images is nontrivial and version tags are acceptable for CI service containers. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 27d3ce0..3335d23 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -43,7 +43,7 @@ jobs: database: [sqlite, postgres, mysql] services: redis: - image: redis + image: redis # zizmor: ignore[unpinned-images] -- version tag is fine for service containers ports: - 6379:6379 postgres: From 225682f994f86eb7bec43bf8ec6a23299bc70362 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 15:15:46 -0400 Subject: [PATCH 5/7] Fix excessive-permissions and artipacked findings Set permissions: {} at workflow level and scope contents: read per job. Add persist-credentials: false to all checkout steps. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/build.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3335d23..9953a55 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,13 +1,19 @@ name: Build on: [push] +permissions: {} + jobs: rubocop: name: Rubocop runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout code uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + with: + persist-credentials: false - name: Setup Ruby and install gems uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0 with: @@ -19,6 +25,8 @@ jobs: lint-actions: name: GitHub Actions audit runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -36,6 +44,8 @@ jobs: tests: name: Tests runs-on: ubuntu-latest + permissions: + contents: read strategy: fail-fast: false matrix: @@ -73,6 +83,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 + with: + persist-credentials: false - name: Setup Ruby and install gems uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0 with: From 876f9863a63daaf5fe8b13109f71e70ad43b6020 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 15:16:16 -0400 Subject: [PATCH 6/7] Suppress unpinned-images for postgres and percona service containers Digest pinning for container images is nontrivial and version tags are acceptable for CI service containers. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 9953a55..c6baa2d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -57,7 +57,7 @@ jobs: ports: - 6379:6379 postgres: - image: postgres:13.4 + image: postgres:13.4 # zizmor: ignore[unpinned-images] -- version tag is fine for service containers env: POSTGRES_HOST_AUTH_METHOD: "trust" ports: @@ -68,7 +68,7 @@ jobs: --health-timeout 5s --health-retries 5 mysql: - image: percona:5.7.22 + image: percona:5.7.22 # zizmor: ignore[unpinned-images] -- version tag is fine for service containers env: MYSQL_ALLOW_EMPTY_PASSWORD: "yes" ports: From 843d162c0327b8626caef1803353f0c1e5115bb8 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 16:56:29 -0400 Subject: [PATCH 7/7] Pin redis service container to major version tag Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c6baa2d..40a46fc 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -53,7 +53,7 @@ jobs: database: [sqlite, postgres, mysql] services: redis: - image: redis # zizmor: ignore[unpinned-images] -- version tag is fine for service containers + image: redis:7 # zizmor: ignore[unpinned-images] -- version tag is fine for service containers ports: - 6379:6379 postgres: