[security-audit] FAIL on 2026-05-22

[github-actions]

Audit failed at 2026-05-22T18:43Z. Run

Audit step produced no audit-report.md. See workflow run logs.

[github-actions]

Audit failed at 2026-05-22T19:25Z. Run

Audit step produced no audit-report.md. See workflow run logs.

[github-actions]

Audit failed at 2026-05-22T19:56Z. Run

Security Audit Report

Audit date: 2026-05-22. Repository: diffplug/dormouse. Branch: main (single commit: 3df3a81).

---

FAIL IF results

Dependency Supply Chain

#	Check	Result	Evidence
1	node website/scripts/generate-deps.js changes website/src/data/dependencies.json	PASS	Script ran and printed "Wrote 22 dependencies"; git diff --name-only returned empty — file unchanged.
2	pnpm-workspace.yaml missing minimumReleaseAge: 1440	PASS	pnpm-workspace.yaml line 14: minimumReleaseAge: 1440
3	.github/dependabot.yml missing npm coverage for / or Cargo for /standalone/src-tauri	PASS	package-ecosystem: "npm" with directory: "/" and package-ecosystem: "cargo" with directory: "/standalone/src-tauri" both present.
4	.github/dependabot.yml missing dependency cooldown windows	PASS	npm entry has cooldown: {semver-patch-days: 1, semver-minor-days: 3, semver-major-days: 14}; cargo entry has the same fields.

GitHub Actions Policies

#	Check	Result	Evidence
5	pull_request_target in any non-agent-managed workflow	PASS	grep pull_request_target across all non-tend-* workflow files returned no matches. pull_request_target appears only in tend-review.yaml.
6	Non-agent-managed workflow grants write permissions beyond id-token: write / attestations: write	PASS	ci.yml and chromatic.yml have only contents: read. release.yml top-level has contents: read; build-standalone and build-vscode jobs have contents: read, id-token: write, attestations: write — both explicitly allowed. publish-vscode has no job-level permissions (inherits workflow-level contents: read).

Automated Maintainer

#	Check	Result	Evidence
7	Merge access ruleset missing, wrong target, wrong rules, or wrong bypass	PASS / UNVERIFIABLE	gh api /repos/.../rulesets/16757376 confirms: name Merge access, target branch, condition ~DEFAULT_BRANCH, single rule update. Bypass actors field absent from API response — requires Administration: read PAT to verify admin-only bypass.
8	Tag operations ruleset missing, wrong target, wrong rules, or wrong bypass	PASS / UNVERIFIABLE	gh api /repos/.../rulesets/16757382 confirms: name Tag operations, target tag, condition ~ALL, rules creation + update. Bypass actors UNVERIFIABLE — same PAT limitation as #7.
9	dormouse-bot holds permission higher than push	PASS	gh api /repos/.../collaborators/dormouse-bot/permission → "permission":"write", "role_name":"write" (GitHub write role = push equivalent). admin, maintain are false.
10	OVSX_PAT or VSCE_PAT appear as repo-level secrets	UNVERIFIABLE	gh api /repos/.../actions/secrets → HTTP 403 "Resource not accessible by integration". Needs AUDIT_PAT with Administration: read.
11	vscode-extension-publish deployment-branch-policies allow non-admin-gated ref	PASS	API response shows exactly one policy: {"name":"v*","type":"tag"}. Tag creation is admin-only per the Tag operations ruleset (blocks creation for ~ALL with admin-only bypass), so only admins can create the tags that reach this environment.
12	CHROMATIC_PROJECT_TOKEN missing from secrets.allowed in .config/tend.yaml	PASS	.config/tend.yaml line 5: - CHROMATIC_PROJECT_TOKEN under secrets.allowed.
13	workflow-audit.yaml missing, disabled, or no successful run in 48 hours	FAIL	File exists and state is active (workflow ID 281750545). However, gh api .../workflow-audit.yaml/runs?per_page=5 returns zero runs of any status. The entire repository has only one commit (3df3a81, 2026-05-22 12:32 PDT), so the workflow has never had a scheduled trigger. First possible run is 2026-05-23 07:13 UTC. The 48-hour window is unmet.
14	Any tend-*.yaml references max-sixty/tend with non-pinned or non-published version	PASS	All nine tend workflows use max-sixty/tend@0.0.25. Git tag 0.0.25 exists on max-sixty/tend. SECURITY.md itself uses @0.0.25 as its positive example. (Note: only 0.0.18 appears as a formal GitHub Release object; 0.0.25 is a tag-only release — accepted per spec example.)
15	Agent-managed workflow grants permission beyond the allowed set	PASS	All tend-*.yaml files use subsets of {contents: write, pull-requests: write, issues: write, id-token: write, actions: read}. workflow-audit.yaml uses {contents: read, issues: write, actions: read}. security-audit.yaml uses {contents: read, actions: read, issues: write, id-token: write}. All within the allowed set.

VS Code Extension Releases

#	Check	Result	Evidence
16	release.yml missing vscode-extension-publish environment on VS Code publish job	PASS	release.yml publish-vscode job has environment: name: vscode-extension-publish.
17	VSCE_PAT or OVSX_PAT used outside vscode-extension-publish environment	PASS	grep across all workflow files: VSCE_PAT at release.yml:265 and OVSX_PAT at release.yml:277, both within the publish-vscode job which has the vscode-extension-publish environment. No other references found.
18	release.yml uses production desktop signing secrets in CI	PASS	release.yml sets TAURI_SIGNING_PRIVATE_KEY to the path of an ephemeral key generated in the same step (pnpm tauri signer generate --ci). No production signing secret is referenced.
19	release.yml stops generating ephemeral Tauri updater key	PASS	build-standalone job contains "Generate ephemeral Tauri updater key" step at release.yml line ~63–72.

Desktop Releases

#	Check	Result	Evidence
20	sign-and-deploy.sh stops verifying GitHub artifact attestations	PASS	scripts/sign-and-deploy.sh lines 391–398: gh attestation verify "$manifest" called for each artifact; check_gh_attestation_support guards the command.
21	sign-and-deploy.sh stops verifying artifact SHA-256 manifests	PASS	Lines 358–401: check_sha256_manifest uses sha256sum -c (Linux) or shasum -a 256 -c (macOS) to verify artifact-manifest.sha256 for every artifact bundle.
22	sign-and-deploy.sh stops using PIV-backed Windows signing	PASS	Lines 687–710: jsign --storetype PIV --alias AUTHENTICATION with EV_SIGN_PIN prompted at runtime; jsign is called twice (exe + NSIS installer).

CI Validation Contract

#	Check	Result	Evidence
23	security-audit.yaml missing, disabled, or not invoked from release.yml publish path	PASS	security-audit.yaml state is active. release.yml has security-audit: uses: ./.github/workflows/security-audit.yaml; publish-vscode lists security-audit in its needs array, making it a hard gate.
24	Audit has been weakened	PASS	security-audit.yaml prompt contains the full qualitative-pass requirement. "Surface result" step opens or appends to a security-audit-failure issue and calls exit 1 on FAIL. No FAIL IF is skipped or ignorable.

---

Qualitative findings

BLOCKER — Non-SHA-pinned actions in agent-managed workflows

All tend-*.yaml and workflow-audit.yaml use actions/checkout@v6 (a mutable version tag, not a commit SHA). tend-install-test.yaml additionally uses astral-sh/setup-uv@v6.

SECURITY.md states: "GitHub Actions are always pinned by commit hash, not version tag" and "The other actions inside tend's workflows must still be SHA-pinned per the rule above." The non-max-sixty/tend actions are explicitly not exempted.

By contrast, security-audit.yaml (also agent-managed) is fully SHA-pinned (actions/checkout@de0fac2e…, actions/setup-node@48b55a01…, pnpm/action-setup@0e279bb9…).

Why this matters: Bot workflows run with contents: write and can push feature branches. If the actions/checkout@v6 tag is mutated by a supply-chain compromise, every scheduled and event-triggered bot workflow executes attacker-controlled code with push access to the repository. The agent's existing workflow scope on its PAT means a compromised action step could author and push new workflow files.

Affected files and lines:

• .github/workflows/tend-ci-fix.yaml:26 — actions/checkout@v6
• .github/workflows/tend-install-test.yaml:26 — actions/checkout@v6
• .github/workflows/tend-install-test.yaml:27 — astral-sh/setup-uv@v6
• .github/workflows/tend-mention.yaml:162 — actions/checkout@v6
• .github/workflows/tend-nightly.yaml:26 — actions/checkout@v6
• .github/workflows/tend-notifications.yaml:92 — actions/checkout@v6
• .github/workflows/tend-review-runs.yaml:26 — actions/checkout@v6
• .github/workflows/tend-review.yaml:44 — actions/checkout@v6
• .github/workflows/tend-triage.yaml:29 — actions/checkout@v6
• .github/workflows/tend-weekly.yaml:26 — actions/checkout@v6
• .github/workflows/workflow-audit.yaml:26 — actions/checkout@v6

Fix: Replace each @v6 tag with the SHA of the commit that tag currently points to, matching the pattern used in security-audit.yaml. Dependabot will keep the SHAs up to date automatically.

---

INFO — workflow-audit.yaml has zero run history (new repository)

The workflow-audit.yaml FAIL IF check (#13) records a FAIL because no successful run exists within 48 hours. This is because the entire repository has only a single commit (pushed 2026-05-22 12:32 PDT). The scheduled 7:13 UTC trigger has not fired yet. The first run is expected 2026-05-23; once it completes successfully, this check will pass. No remediation is needed — this is expected for a freshly initialized repository.

---

INFO — max-sixty/tend@0.0.25 is a git tag but not a formal GitHub Release

gh api .../releases/tags/0.0.25 returns 404; only 0.0.18 is a formal GitHub Release. However, 0.0.25 exists as a git tag. SECURITY.md itself uses (e.g. @0.0.25) as its positive example, so the reference is interpreted as conformant. No action required; recorded for transparency.

---

INFO — Ruleset bypass actor list unverifiable with default GITHUB_TOKEN

Checks #7 and #8 confirmed that Merge access and Tag operations rulesets exist with the correct targets and rule types, but the bypass actor list is not included in the API response at the current token's permission level. Full verification requires a PAT with Administration: read. Both rulesets report current_user_can_bypass: "never" for this workflow token, consistent with admin-only bypass.

---

INFO — Repo-level secrets list unverifiable with default GITHUB_TOKEN

Check #10 (OVSX_PAT/VSCE_PAT not in repo-level secrets) returned HTTP 403. This check requires a PAT with Administration: read. The workflow files confirm these secrets are only referenced inside the vscode-extension-publish-scoped job in release.yml, reducing confidence the secrets themselves are correctly scoped.

---

Summary

Overall status: FAIL

Two findings drive the failure. First, FAIL IF check #13: workflow-audit.yaml has produced no successful run in the last 48 hours. The repository has only one commit (pushed today), so the nightly schedule has not yet fired — the check fails on its literal terms even though the cause is benign. Second, and more significantly, a BLOCKER-severity qualitative finding: all tend-*.yaml and workflow-audit.yaml use actions/checkout@v6 (plus astral-sh/setup-uv@v6 in one file) rather than SHA-pinned references. SECURITY.md explicitly requires SHA pinning for all actions other than max-sixty/tend itself inside agent-managed workflows. This is a live supply-chain attack surface: bot workflows execute with contents: write on feature branches, so a tag-mutation compromise of the checkout action could allow an attacker to push malicious workflow files. security-audit.yaml demonstrates the correct pattern and must be matched by the other agent-managed workflows.

[github-actions]

Audit passed at 2026-05-22T20:13Z. Run