Skip to content

root - chore: defense - gate stage-publish on Aikido scan-release #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jaredwray merged 2 commits into from
Sep 9, 2026
Merged

root - chore: defense - gate stage-publish on Aikido scan-release #75

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e544607
root - chore: defense - gate stage-publish on Aikido scan-release
cursoragent Sep 9, 2026
2e902e5
docs: mark Aikido scan-release gate as PR #75 pending
cursoragent Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 37 additions & 3 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,51 @@ on:

permissions:
contents: read
id-token: write

env:
HYPHEN_PUBLIC_API_KEY: ${{ secrets.HYPHEN_PUBLIC_API_KEY }}
HYPHEN_APPLICATION_ID: ${{ secrets.HYPHEN_APPLICATION_ID }}

jobs:
build:

scan-release:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Install Socket Firewall
uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
with:
mode: firewall-free
firewall-version: "1.15.1"

- name: Set up Node.js
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
package-manager-cache: false

- name: Install Aikido CI client
# zizmor: ignore[adhoc-packages] pinned Aikido CI client for the release gate
run: sfw npm install --global @aikidosec/ci-api-client@1.0.17

# Fails on new SAST/IaC/secrets findings. The API key comes from Aikido's
# Continuous Integration settings — it grants no publish authority.
- name: Run Aikido release scan
env:
REPO_NAME: ${{ github.event.repository.name }}
AIKIDO_CLIENT_API_KEY: ${{ secrets.AIKIDO_CLIENT_API_KEY }}
run: >
aikido-api-client scan-release
"$REPO_NAME" "$GITHUB_SHA"
--apikey "$AIKIDO_CLIENT_API_KEY"
--fail-on-sast-scan --fail-on-iac-scan --fail-on-secrets-scan

build:
needs: [scan-release]
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
Expand Down
4 changes: 2 additions & 2 deletions DEFENSE_IN_DEPTH.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,15 +36,15 @@ Profile: npm library · public

## 5. npm publishing — npm libraries only
- [ ] OIDC trusted publishing configured **stage-only** on npmjs.com for the publish workflow — it can stage, never publish live (manual)
- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` (PR #74 pending)
- [x] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` — PR #74
- [ ] Maintainer promotes staged versions with 2FA (manual)
- [ ] Drydock connected — staged releases reviewed before promotion (manual)
- [ ] No direct publish rights: package requires 2FA and disallows tokens (manual)
- [x] `package.json` `repository.url` accurate so provenance maps to this repo — verified 2026-09-09

## 6. Security tooling
- [x] Aikido runs on every build — verified 2026-09-09 (PR #65: Aikido Security: check code)
- [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release`
- [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release` (PR #75 pending)
- [ ] Socket reviews every PR that changes dependencies

## 7. Repository lockdown
Expand Down
2 changes: 1 addition & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ hardening checklist; progress is tracked in [DEFENSE_IN_DEPTH.md](./DEFENSE_IN_D
- Dependencies install through pnpm with a 7-day cooldown on new versions, lifecycle scripts blocked by default, `trustPolicy: no-downgrade`, and exotic subdependencies blocked.
- The lockfile is committed and CI installs with `--frozen-lockfile`. There is no Dependabot config; dependency updates go through reviewed PRs.
- CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`; zizmor lints workflows on every PR; checkouts that do not push set `persist-credentials: false`.
- The release workflow disables `setup-node` package-manager caching.
- The release workflow disables `setup-node` package-manager caching and stages packed tarballs with `pnpm stage publish` instead of publishing live.

@gemini-code-assist gemini-code-assist Bot Sep 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The pull request title and description state that this PR adds an Aikido scan-release job and gates the stage-publish job on it. However, the actual workflow file (e.g., .github/workflows/release.yaml) is missing from the changes in this PR. Only documentation files (DEFENSE_IN_DEPTH.md and SECURITY.md) are currently modified. Please include the workflow file changes in this PR.

@cursor cursor Bot Sep 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow change is in this PR. .github/workflows/release.yaml is modified on the first commit (e544607): it adds the scan-release job and build now needs: [scan-release]. The second commit only updates DEFENSE_IN_DEPTH.md with the pending PR number, which is likely what this review looked at in isolation.

Files in the PR: .github/workflows/release.yaml, DEFENSE_IN_DEPTH.md, SECURITY.md.

- Workflows do not use `pull_request_target`.
- The published package sets `repository.url` to this repo so provenance can map back.
- `.github/CODEOWNERS` names `@jaredwray` for `/.github/`, `/.vscode/`, `/.cursor/`, `/.devcontainer/`, and `/scripts/`.
Expand Down