Harden CI/CD supply chain: SHA-pin actions, scope perms, verify martin [skip release]#22
Merged
Merged
Conversation
…kip release] The audit's one High. Pins the deploy pipeline against supply-chain drift: - SHA-pin every GitHub Action across all workflows (version kept as a trailing comment), so a moved tag can't swap action code under us. Add Dependabot (github-actions, weekly) to bump the pins. - deploy.yml: replace the workflow-level union of permissions with a contents:read floor + per-job escalation — only infra/web get the OIDC id-token, and only web gets deployments:write. The changes (paths-filter) job no longer receives a token it never used. - Pin cargo-lambda (==1.9.1) in both the ci cdk job and the deploy infra job. - Pin the martin release (martin-v1.11.0) and verify its tarball sha256 before packaging — download to a file, check, then extract (was a curl|tar of "latest" with no integrity check). Override via MARTIN_RELEASE + MARTIN_SHA256. README: document the supply-chain posture in the IaC section. Out of scope (a local admin op, not CI): tightening the CDK bootstrap cfn-exec role / OIDC AssumeRole boundary — tracked separately.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The audit's only High. Hardens the deploy/release pipeline against supply-chain drift.
Changes
@<sha> # v6) so it stays readable and Dependabot-trackable. A moved/retagged action can no longer swap code into our pipeline.github-actions, weekly) — bumps the pins so they don't rot. Scoped to actions for now (npm/cargo left out to limit PR volume).{id-token, contents, deployments}union is replaced with acontents: readfloor; each job escalates only what it needs. Thechanges(paths-filter) job no longer receives an OIDCid-tokenit never used;infra/webgetid-token, onlywebgetsdeployments.cargo-lambda==1.9.1in both the cicdkjob and the deployinfrajob.curl … latest | tarwith no integrity check. Now downloads a pinned release (martin-v1.11.0) to a file, verifies its sha256, then extracts. Overridable viaMARTIN_RELEASE+MARTIN_SHA256.Verification
actionlintclean on all workflows.build-martin-lambda.shend-to-end: sha256 verified, zip built. The cicdkjob runs this same script, so the gate is exercised on ubuntu on this PR (pre-merge).Out of scope
Tightening the CDK bootstrap
cfn-execrole / OIDC AssumeRole permissions-boundary is a local admin op (CI never deploys the OIDC stack), tracked separately.Docs & attribution