From edda299151b98ba9bcea2c0ce7c8ff3cb8d36b3f Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:18:17 +0000 Subject: [PATCH 1/3] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 7 ++++--- .github/workflows/codeql.yml | 12 ++++++++++++ .../workflows/debug-artifacts-failure-safe.yml | 12 ++++++++++++ .github/workflows/debug-artifacts-safe.yml | 12 ++++++++++++ .github/workflows/post-release-mergeback.yml | 6 ++++++ .github/workflows/pr-checks.yml | 6 ++++++ .github/workflows/prepare-release.yml | 6 ++++++ .github/workflows/python312-windows.yml | 6 ++++++ .github/workflows/query-filters.yml | 6 ++++++ .github/workflows/rebuild.yml | 6 ++++++ .github/workflows/rollback-release.yml | 6 ++++++ .github/workflows/update-bundle.yml | 6 ++++++ .github/workflows/update-release-branch.yml | 12 ++++++++++++ .pre-commit-config.yaml | 17 +++++++++++++++++ 14 files changed, 117 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d29c1e106c..afaa5e6c29 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -27,10 +27,11 @@ updates: - "patch" - package-ecosystem: github-actions directories: - - "/.github/workflows" - - "/.github/actions" + - /.github/workflows + - /.github/actions + - / schedule: - interval: weekly + interval: daily cooldown: default-days: 7 exclude: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f27de17fd8..2c0945bddf 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,6 +32,12 @@ jobs: security-events: read steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up default CodeQL bundle id: setup-default @@ -119,6 +125,12 @@ jobs: security-events: write steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index f67cef5c75..6aefd8ed6b 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -45,6 +45,12 @@ jobs: timeout-minutes: 45 runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Dump GitHub event run: cat "${GITHUB_EVENT_PATH}" - name: Check out repository @@ -88,6 +94,12 @@ jobs: contents: read runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Download all artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - name: Check expected artifacts exist diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index c27f195113..07868a624a 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -43,6 +43,12 @@ jobs: security-events: read runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test @@ -81,6 +87,12 @@ jobs: contents: read runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Download all artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - name: Check expected artifacts exist diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index c493c2a382..5c2ce97035 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -36,6 +36,12 @@ jobs: pull-requests: write steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Dump environment run: env diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index ac61475d62..a8a2a6af7a 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -87,6 +87,12 @@ jobs: group: pr-checks-pr-checks-${{ github.ref }}-${{ github.event_name }} steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 4eb300704d..e7ab04b279 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -43,6 +43,12 @@ jobs: backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }} steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index ab169499e2..15e9164d99 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -32,6 +32,12 @@ jobs: runs-on: windows-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.12 diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 87b934eb6b..fb18465a1b 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -29,6 +29,12 @@ jobs: permissions: contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository. steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index faa32c65d9..5ae0d190e5 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -23,6 +23,12 @@ jobs: contents: write # needed to push rebuilt commit pull-requests: write # needed to comment on the PR steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index c37f8a79ae..d48f4ec21f 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -51,6 +51,12 @@ jobs: pull-requests: write # needed to create the mergeback PR steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index d3ee924e59..09af549161 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -25,6 +25,12 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull requests steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Dump environment run: env diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index 9f38f0f0b4..938256001f 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -38,6 +38,12 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs @@ -93,6 +99,12 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Generate token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 id: app-token diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e1ae3d243a..b97f742ffe 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -18,3 +18,20 @@ repos: language: system entry: pr-checks/sync.sh pass_filenames: false + - repo: https://github.com/gitleaks/gitleaks + rev: v8.30.1 + hooks: + - id: gitleaks + - repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck + - repo: https://github.com/pre-commit/mirrors-eslint + rev: v10.8.0 + hooks: + - id: eslint + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v6.0.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace From 7e27b359df431ba349747b7e6caf7d3e11b7fa47 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 17 Aug 2026 23:53:34 +0000 Subject: [PATCH 2/3] Bump js-yaml and tar to patched versions (dev-only transitives) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears the two open advisories reported by `npm audit` against the locked dependency tree. Both fixes land inside the existing semver ranges, so only `package-lock.json` changes: - js-yaml 4.3.0 -> 4.3.1 and 3.15.0 -> 3.15.1 (GHSA-5p4m-2wfm-xmqj, CVE-2026-59870, high): quadratic CPU consumption resolving `!!omap`. Reached via @microsoft/eslint-formatter-sarif and supertap. - tar 7.5.20 -> 7.5.22 (GHSA-r292-9mhp-454m, moderate): uncontrolled recursion in mapHas/filesFilter allows an uncatchable stack-overflow DoS from a crafted long-path archive. Reached via @mapbox/node-pre-gyp. All three are dev-only dependencies, so the bundled output in `lib/` does not change and needs no rebuild. The root `js-yaml` direct dependency stays pinned at 5.2.3 — the 5.x line was already patched in 5.2.1 and is unaffected, so it is deliberately left out of this diff to keep the change security-scoped. Verified locally: `npm ci`, `npm run build`, and `npm run lint` all pass, and `npm audit` reports 0 vulnerabilities. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01QVUWKDpMHifLWzEYPF4NKL --- package-lock.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index 6a74ca0270..bce5699de2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1980,9 +1980,9 @@ } }, "node_modules/@microsoft/eslint-formatter-sarif/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { @@ -8934,9 +8934,9 @@ } }, "node_modules/supertap/node_modules/js-yaml": { - "version": "3.15.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", - "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", + "version": "3.15.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", + "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", "dev": true, "license": "MIT", "dependencies": { @@ -9013,9 +9013,9 @@ } }, "node_modules/tar": { - "version": "7.5.20", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.20.tgz", - "integrity": "sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==", + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { From e5d08eb130daeb715219ee7b419f5b788f662e0a Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 27 Aug 2026 16:03:27 +0000 Subject: [PATCH 3/3] docs: add FORK.md explaining this fork and its related repositories Nothing in the tree said this was a fork, why it exists, or how it relates to the SakThai repos that sit alongside it. Add FORK.md recording the two dev-only advisory bumps it carries (js-yaml GHSA-5p4m-2wfm-xmqj, tar GHSA-r292-9mhp-454m), links to the sibling repos, and the point that matters most: no workflow in those repos references this fork. They pin upstream `github/codeql-action` by commit SHA, and repointing them here would defeat the SHA-pinning Scorecard's Pinned-Dependencies check relies on. The README gets a single blockquote line pointing at FORK.md, kept to one line so syncing from upstream stays a trivial resolution. Everything else in README.md is upstream's and is untouched. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DKk5SVtHLSPCwSDASJhfRL --- FORK.md | 38 ++++++++++++++++++++++++++++++++++++++ README.md | 2 ++ 2 files changed, 40 insertions(+) create mode 100644 FORK.md diff --git a/FORK.md b/FORK.md new file mode 100644 index 0000000000..38080a9eac --- /dev/null +++ b/FORK.md @@ -0,0 +1,38 @@ +# Fork notes + +This is a fork of [`github/codeql-action`](https://github.com/github/codeql-action), +maintained under [`beer-sakthai`](https://github.com/beer-sakthai) alongside the SakThai +family repositories. Upstream's own documentation in [`README.md`](README.md) still +applies in full — this file records only what is specific to the fork. + +## Why the fork exists + +To stage dependency-advisory remediation against the action's **own** dev-dependency +tree, where a fix is available inside the existing semver ranges and touches only +`package-lock.json`. So far: + +- `js-yaml` 4.3.0 → 4.3.1 and 3.15.0 → 3.15.1 (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870) +- `tar` 7.5.20 → 7.5.22 (GHSA-r292-9mhp-454m) + +Both are dev-only, so the bundled output under `lib/` is unchanged and needs no rebuild. + +## What the fork is *not* + +**No workflow in the SakThai repositories references this fork.** They pin **upstream** +`github/codeql-action` by commit SHA: + +- [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) — + `codeql.yml`, `bandit.yml`, `ossar.yml`, `scorecard.yml` +- [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) — + `codeql.yml`, `ossar.yml` + +Repointing any of them at this fork would defeat the SHA-pinning those repos rely on for +Scorecard's Pinned-Dependencies check. Consume upstream; use this fork to prepare patches. + +## Related repositories + +| Repository | What it is | +|---|---| +| [`github/codeql-action`](https://github.com/github/codeql-action) | Upstream. The source of truth for everything in `README.md` and `CHANGELOG.md`. | +| [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) | The Sak family agent runtime — `sakthai` package, six personas, memory, MCP, web API. | +| [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) | The SFT + GRPO training and evaluation pipeline behind the family's models. | diff --git a/README.md b/README.md index 530c028f97..81b0f634cf 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # CodeQL Action +> **Fork of [`github/codeql-action`](https://github.com/github/codeql-action).** See [`FORK.md`](FORK.md) for what differs and for the related SakThai repositories. Everything below is upstream documentation and applies unchanged. + This action runs GitHub's industry-leading semantic code analysis engine, [CodeQL](https://codeql.github.com/), against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code. For a list of recent changes, see the CodeQL Action's [changelog](CHANGELOG.md).