Repository navigation
test(security): annotate intentional hardcoded-password detection fixture #124
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> | |
| # | |
| # Source integrity checks cannot establish GitHub's effective live Actions | |
| # policy or explain a zero-job startup failure without its actual diagnostic. | |
| # Native lock generation belongs to the published canonical recovery chain. | |
| name: CI Integrity | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main, master] | |
| schedule: | |
| - cron: '17 5 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-integrity-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| YQ_VERSION: v4.54.1 | |
| STANDARDS_REF: 087f6bff5135ce3da6f287c83752256ce4a8efc1 | |
| jobs: | |
| integrity: | |
| name: CI integrity (pins, lock, allowlist, YAML) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Initialize runner-local paths and evidence | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| standards_root="$RUNNER_TEMP/panic-ci-integrity-standards" | |
| evidence_dir="$RUNNER_TEMP/panic-ci-integrity-evidence" | |
| mkdir -p "$evidence_dir" | |
| printf 'not_run\n' > "$evidence_dir/native.exit" | |
| { | |
| printf 'STANDARDS_ROOT=%s\n' "$standards_root" | |
| printf 'ACTIONS_LOCK_EVIDENCE_DIR=%s\n' "$evidence_dir" | |
| } >> "$GITHUB_ENV" | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install checksum-qualified YAML and native lock tools | |
| run: | | |
| set -euo pipefail | |
| tool_dir="$RUNNER_TEMP/panic-ci-integrity-bin" | |
| mkdir -p "$tool_dir" | |
| curl --fail --show-error --silent --location --proto '=https' --proto-redir '=https' --tlsv1.2 --retry 3 --max-time 60 \ | |
| "https://github.com/mikefarah/yq/releases/download/$YQ_VERSION/yq_linux_amd64" -o "$tool_dir/yq" | |
| printf '%s %s\n' '8e34fc298390875de416e6a4afcb8cabeceb25d9aa8506c1a2f9353cf702ea5f' "$tool_dir/yq" | sha256sum --check | |
| curl --fail --show-error --silent --location --proto '=https' --proto-redir '=https' --tlsv1.2 --retry 3 --max-time 60 \ | |
| https://github.com/github/gh-actions-lock/releases/download/v0.2.0/linux-amd64 -o "$tool_dir/gh-actions-lock" | |
| printf '%s %s\n' '79ec84c191667fd935a277e6fd3662cf5d3669cccc9e99998731d8f306f373b6' "$tool_dir/gh-actions-lock" | sha256sum --check | |
| chmod u+x "$tool_dir/yq" "$tool_dir/gh-actions-lock" | |
| "$tool_dir/yq" --version | |
| printf '%s\n' "$tool_dir" >> "$GITHUB_PATH" | |
| printf 'GH_ACTIONS_LOCK_BIN=%s\n' "$tool_dir/gh-actions-lock" >> "$GITHUB_ENV" | |
| - name: Fetch unchanged published canonical helpers | |
| run: | | |
| set -euo pipefail | |
| git init --quiet "$STANDARDS_ROOT" | |
| timeout 120 git -C "$STANDARDS_ROOT" fetch --quiet --no-tags --depth=1 \ | |
| https://github.com/metadatastician/standards.git "$STANDARDS_REF" | |
| git -C "$STANDARDS_ROOT" checkout --quiet --detach FETCH_HEAD | |
| test "$(git -C "$STANDARDS_ROOT" rev-parse HEAD)" = "$STANDARDS_REF" | |
| - name: CI integrity regression controls | |
| run: bash scripts/ci/test-ci-integrity.sh | |
| - name: SHA pins (canon rule 10) | |
| run: bash .githooks/validate-sha-pins.sh | |
| - name: Canonical executable workflow coordinates | |
| run: bash "$STANDARDS_ROOT/scripts/check-workflow-coordinates.sh" .github/workflows | |
| - name: Native lock coverage and canonical lock sync | |
| run: bash .githooks/validate-actions-lock.sh | |
| - name: Exact tree allowlist (live Settings unverified) | |
| run: bash scripts/ci/check-allowed-actions.sh .github/actions-allowlist.json .github/workflows | |
| - name: Startup-failure source triage | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| if [ "${{ github.event_name }}" = workflow_dispatch ]; then | |
| bash scripts/ci/triage-startup-failure.sh | |
| else | |
| bash scripts/ci/triage-startup-failure.sh --report | |
| fi | |
| - name: Every workflow parses and has a jobs map | |
| run: | | |
| set -euo pipefail | |
| fail=0 | |
| for f in .github/workflows/*.yml .github/workflows/*.yaml; do | |
| [ -e "$f" ] || continue | |
| if ! yq -e '.' "$f" >/dev/null 2>&1; then | |
| echo "::error file=$f::does not parse as YAML" | |
| fail=1 | |
| continue | |
| fi | |
| if [ "$(yq -r '.jobs | tag' "$f")" != '!!map' ]; then | |
| echo "::error file=$f::parses but declares no jobs: map" | |
| fail=1 | |
| fi | |
| done | |
| exit "$fail" | |
| - name: Retain raw native result and immutable source identity | |
| if: always() | |
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | |
| with: | |
| name: ci-integrity-native-${{ github.run_id }}-${{ github.run_attempt }} | |
| path: ${{ runner.temp }}/panic-ci-integrity-evidence | |
| if-no-files-found: error | |
| retention-days: 14 | |
| - name: Summary | |
| if: always() | |
| run: | | |
| { | |
| echo '## CI integrity' | |
| echo '' | |
| echo 'Step conclusions record the result; this table describes each gate.' | |
| echo '' | |
| echo '| Gate | Scope |' | |
| echo '|------|-------|' | |
| echo '| SHA pins and coordinates | Immutable refs and canonical executable repository names |' | |
| echo '| Native lock | Official v0.2.0 result, unchanged published reconciliation and bidirectional lock sync |' | |
| echo '| Tree allowlist | Complete action/workflow path and exact SHA, without a live Settings claim |' | |
| echo '| YAML parse | Readable workflow documents with a jobs map |' | |
| echo '| Startup triage | Source/API observations; no inferred platform root cause from zero jobs alone |' | |
| echo '' | |
| echo 'The raw artifact records not_run if consumer verification never executed, or running if no native exit was recorded.' | |
| } >> "$GITHUB_STEP_SUMMARY" |