chore(security): harden GitHub Actions and repo policies by guo · Pull Request #4822 · iotexproject/iotex-core

guo · 2026-04-11T00:38:41Z

Summary

Hardens repository security posture across GitHub Actions, CODEOWNERS, and disclosure policy.

Workflows

Remove chatgpt.yaml — AI code review is handled separately (and the third-party action had permissions: write-all, a serious risk).
Pin moving refs to SHAs:
- securego/gosec@master → @53aee87... (v2.9.6)
- github/codeql-action/*@v1|v2 → @3b1a19a... (v3)
Upgrade outdated actions: checkout@v2/v3 → @v4, setup-go@v2 → @v5 in release.yaml.
Align Go version: bump release.yaml from 1.22.12 → 1.23.0 to match CI (removes version drift).
Tighten permissions:
- ci.yaml: drop unneeded packages: write and pull-requests: read.
- release.yaml: add explicit top-level permissions: contents: write.
Replace insecure codecov upload: bash <(curl -s codecov.io/bash) → codecov/codecov-action@v5 with CODECOV_TOKEN.

Supply chain

Add .github/dependabot.yml for github-actions, gomod, and docker ecosystems. Dependabot will keep action SHAs pinned and up-to-date going forward.

Governance

Expand CODEOWNERS: @iotexproject/security team co-reviews .github/, workflows, Dockerfile, go.mod/go.sum. Protocol team explicitly owns crypto/, consensus/, blockchain/, state/, action/protocol/, blockchain/genesis/, config/.
Add SECURITY.md with private vulnerability reporting (GitHub Security Advisories + email), response SLAs, scope, and safe harbor clause.

Manual steps required after merge

These cannot be set via code — repo admin needs to toggle in UI:

Settings → Branches → master: require PR with ≥2 approvals, require review from Code Owners, require signed commits, required status checks (ci flow, CodeQL-Build), dismiss stale approvals, enforce on admins.
Settings → Code security: enable Dependabot alerts + security updates, Secret scanning + Push protection, CodeQL.
Settings → Actions → General: require approval for first-time contributors on fork PRs; default GITHUB_TOKEN to read-only.
Settings → Secrets: confirm CODECOV_TOKEN is set (currently missing → coverage upload will no-op but CI won't fail).
Org: enforce 2FA for all @iotexproject members.

Test plan

CI (ci flow) passes on this PR
CodeQL workflow still completes (run manually via workflow_dispatch to verify v3 upgrade)
Gosec workflow still completes (run manually via workflow_dispatch)
Docker build workflow passes on PR event
CODEOWNERS parse errors checked in GitHub UI (Settings → Code owners tab)
After merge, tag a test release on a throwaway branch to verify release.yaml Go 1.23 build succeeds (or wait for next tagged release)

- Remove chatgpt.yaml (AI review handled separately) - Pin securego/gosec@master to v2.9.6 commit SHA - Upgrade github/codeql-action v1/v2 to v3 (pinned SHA) - Bump actions/checkout v2/v3 to v4 in analysis/gosec/release - Bump actions/setup-go v2 to v5 in release; align Go 1.23.0 - Add top-level permissions: contents: write to release.yaml - Drop unneeded packages: write / pull-requests: read from ci.yaml - Replace curl-pipe codecov uploader with codecov-action@v5 - Add .github/dependabot.yml for github-actions, gomod, docker - Expand CODEOWNERS: security team reviews workflows, Dockerfile, go.mod/go.sum; protocol team on crypto/consensus/blockchain/state - Add SECURITY.md with private disclosure policy and safe harbor

Drop specific SLAs and safe harbor language to avoid committing to promises without an established security response process. Keep only the essential: point reporters at GitHub Private Vulnerability Reporting.

Both ci.yaml (1.23.0) and release.yaml (1.22.12 → 1.23.0) were below go.mod's required 1.24.6. CI was working only because GOTOOLCHAIN=auto silently downloaded the correct toolchain at build time — which defeats setup-go caching and breaks if GOTOOLCHAIN=local is ever set. Switch to go-version-file: go.mod so the workflow installs the exact version go.mod requires. Eliminates version drift permanently.

Prepares for flipping repo-wide default GITHUB_TOKEN permissions to read-only. gosec.yaml uploads SARIF via codeql-action/upload-sarif, which requires security-events: write.

sonarqubecloud · 2026-04-11T00:55:36Z

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Hardens the repository’s security posture by tightening GitHub Actions workflows, adding supply-chain automation (Dependabot), and strengthening governance via CODEOWNERS and a security reporting policy.

Changes:

Tighten and modernize GitHub Actions workflows (reduced permissions, updated actions, pin select actions to SHAs, replace Codecov bash uploader).
Add Dependabot configuration for GitHub Actions, Go modules, and Docker updates.
Update governance/security docs (expanded CODEOWNERS; add SECURITY.md; remove ChatGPT review workflow).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
SECURITY.md	Adds a security reporting policy (private vulnerability reporting link).
.github/workflows/release.yaml	Updates Go setup and adds explicit release permissions.
.github/workflows/gosec.yaml	Pins gosec and upload-sarif to specific commits and tightens job permissions.
.github/workflows/ci.yaml	Uses setup-go v5 + go-version-file and replaces Codecov bash uploader with the Codecov action; reduces permissions.
.github/workflows/chatgpt.yaml	Removes a third-party AI review workflow (write-all permissions).
.github/workflows/analysis.yaml	Upgrades checkout and pins CodeQL init/analyze to a specific commit.
.github/dependabot.yml	Adds weekly Dependabot updates for actions, Go modules, and Docker.
.github/CODEOWNERS	Expands ownership rules for security-sensitive paths and workflows.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-13T04:31:22Z

      - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
        with:
-          go-version: 1.23.0
+          go-version-file: go.mod
          cache: false


PR description says CI should upgrade actions/checkout v3→v4, but this workflow still uses actions/checkout@v3. Please update this workflow to checkout@v4 (and ideally pin to a commit SHA if the goal is supply-chain hardening).

Copilot · 2026-04-13T04:31:22Z

-          bash <(curl -s https://codecov.io/bash)
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5


codecov/codecov-action@v5 is a third-party action and is still referenced by a mutable tag. To avoid supply-chain risk (and to align with the pinned-SHA approach used elsewhere in this PR), pin this action to a specific commit SHA.

Suggested change

uses: codecov/codecov-action@v5

uses: codecov/codecov-action@0d4f8d86b5b0b5fb9b8d3c8f5d6d0c4585d8b0f2 # v5

Copilot · 2026-04-13T04:31:23Z

+Please report suspected vulnerabilities privately through GitHub Private
+Vulnerability Reporting:
+
+<https://github.com/iotexproject/iotex-core/security/advisories/new>
+
+Include a description of the issue, reproduction steps, and the affected
+version or commit hash. We will acknowledge your report and coordinate a
+disclosure timeline with you.


This SECURITY.md only describes GitHub vulnerability reporting, but the PR description claims it also includes email reporting, response SLAs, scope, and a safe-harbor clause. Either expand this policy to include those items, or adjust the PR description so it matches what’s actually being added.

Copilot · 2026-04-13T04:31:23Z

+permissions:
+  contents: write
+


This workflow still uses svenstaro/upload-release-action@v2 (mutable tag) later in the job, which is a third-party action with release write privileges. For supply-chain hardening, pin it to a commit SHA (similar to how CodeQL/Gosec are pinned in this PR).

guo requested a review from a team as a code owner April 11, 2026 00:38

guo added 3 commits April 10, 2026 17:42

docs(security): trim SECURITY.md to minimal disclosure pointer

3669769

Drop specific SLAs and safe harbor language to avoid committing to promises without an established security response process. Keep only the essential: point reporters at GitHub Private Vulnerability Reporting.

ci(gosec): add explicit job permissions

6b3ddd4

Prepares for flipping repo-wide default GITHUB_TOKEN permissions to read-only. gosec.yaml uploads SARIF via codeql-action/upload-sarif, which requires security-events: write.

envestcc requested a review from Copilot April 13, 2026 04:28

Copilot started reviewing on behalf of envestcc April 13, 2026 04:29 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

envestcc approved these changes Apr 13, 2026

View reviewed changes

CoderZhi approved these changes May 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(security): harden GitHub Actions and repo policies#4822

chore(security): harden GitHub Actions and repo policies#4822
guo wants to merge 4 commits into
masterfrom
chore/harden-github-security

guo commented Apr 11, 2026

Uh oh!

sonarqubecloud Bot commented Apr 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

Copilot AI Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	uses: codecov/codecov-action@v5
	uses: codecov/codecov-action@0d4f8d86b5b0b5fb9b8d3c8f5d6d0c4585d8b0f2 # v5

Conversation

guo commented Apr 11, 2026

Summary

Workflows

Supply chain

Governance

Manual steps required after merge

Test plan

Uh oh!

sonarqubecloud Bot commented Apr 11, 2026

Quality Gate failed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants