Harden CI workflows and remediate supply-chain security findings - #1948
Merged
Conversation
- Upgrade GitHub Actions to latest majors (checkout v7, setup-node v6, codecov v7, upload-artifact v7, download-artifact v8) and pin all references to immutable commit SHAs. - Add StepSecurity harden-runner (v2.19.4) to every workflow job. - Add min-release-age = 7 to .npmrc to block newly published packages. - Add dependabot.yml with cooldown periods and grouped updates.
✅ Deploy Preview for fdc3 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This was referenced Jul 6, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1948 +/- ##
========================================
Coverage 95.32% 95.32%
========================================
Files 85 85
Lines 6690 6690
Branches 811 1028 +217
========================================
Hits 6377 6377
Misses 313 313 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
…1776) (#1888) * feat(conformance): add basicGI2 test for ImplementationMetadata.optionalFeatures (#1776) Adds basicGI2, a conformance test that asserts fdc3.getInfo() returns a valid optionalFeatures object containing booleans for OriginatingAppMetadata, UserChannelMembershipAPIs, and DesktopAgentBridging. Validates shape only, not specific values, so vendor differences in supported features do not cause failures. Refs #1776 * Update testSuite.ts * fix(conformance): cast key to keyof optionalFeatures (TS7053) Adds fdc3BasicGI2 to the basic conformance suite for optionalFeatures coverage from getInfo(). Refs #1776 * test(conformance): drop OriginatingAppMetadata from requiredKeys (3.0) Removed 'OriginatingAppMetadata' from requiredKeys in fdc3 basic tests.
#1868) * chore: switch SAST from semgrep to CodeQL and update Node workflows to v24 - Replace semgrep workflow with CodeQL static analysis (github/codeql-action) to align with OpenSSF Scorecard recognition requirement (issue #1827) - Update CI workflows from Node 20 (EOL) to Node 24 (current LTS): - coverage.yml: Node 20.x to 24.x - release.yml: Node 20 to 24 (all three jobs) - cve-scanning.yml: simplify to single Node 24 (removes matrix) - Add Node engine constraint (>=22) to root package.json per maintainer guidance indicating support floor and future Node 25 capability (issue #1826) Closes #1827 #1826 * fix: restore clean release workflow after rebase
kriswest
changed the title
Contributor
Author
|
@Roaders or @bingenito could you give this quick workflow hardening PR a quick review and approval? After this is done I hope to get back around to reviewing and merging @Roaders PRs! |
Roaders
pushed a commit
that referenced
this pull request
Jul 10, 2026
* chore(ci): harden workflows, pin actions to SHAs, add min-release-age - Upgrade GitHub Actions to latest majors (checkout v7, setup-node v6, codecov v7, upload-artifact v7, download-artifact v8) and pin all references to immutable commit SHAs. - Add StepSecurity harden-runner (v2.19.4) to every workflow job. - Add min-release-age = 7 to .npmrc to block newly published packages. - Add dependabot.yml with cooldown periods and grouped updates. * Update CHANGELOG.md * test(conformance): add optionalFeatures coverage from getInfo() (Refs #1776) (#1888) * feat(conformance): add basicGI2 test for ImplementationMetadata.optionalFeatures (#1776) Adds basicGI2, a conformance test that asserts fdc3.getInfo() returns a valid optionalFeatures object containing booleans for OriginatingAppMetadata, UserChannelMembershipAPIs, and DesktopAgentBridging. Validates shape only, not specific values, so vendor differences in supported features do not cause failures. Refs #1776 * Update testSuite.ts * fix(conformance): cast key to keyof optionalFeatures (TS7053) Adds fdc3BasicGI2 to the basic conformance suite for optionalFeatures coverage from getInfo(). Refs #1776 * test(conformance): drop OriginatingAppMetadata from requiredKeys (3.0) Removed 'OriginatingAppMetadata' from requiredKeys in fdc3 basic tests. * Remove deprecated `name` and `customConfig` from AppD specification (#1937) (#1944) * Remove deprecated name and customConfig from AppD spec (#1937) * Copy updated AppD schema to next (#1937) * Remove reference to deprecated name property in OpenHandler.filterPublicDetails (#1937) Remove 'name' property from filterPublicDetails method. * chore: switch SAST from semgrep to CodeQL and update Node workflows t… (#1868) * chore: switch SAST from semgrep to CodeQL and update Node workflows to v24 - Replace semgrep workflow with CodeQL static analysis (github/codeql-action) to align with OpenSSF Scorecard recognition requirement (issue #1827) - Update CI workflows from Node 20 (EOL) to Node 24 (current LTS): - coverage.yml: Node 20.x to 24.x - release.yml: Node 20 to 24 (all three jobs) - cve-scanning.yml: simplify to single Node 24 (removes matrix) - Add Node engine constraint (>=22) to root package.json per maintainer guidance indicating support floor and future Node 25 capability (issue #1826) Closes #1827 #1826 * fix: restore clean release workflow after rebase * chore(ci): harden and update the actions in the codeql workflow --------- Co-authored-by: ninjabot92 <76234287+ninjabot92@users.noreply.github.com> Co-authored-by: mayank singh <mayankchaudhary.bte05@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #1946
Resolves #1818
Summary
Remediates all blocking Semgrep findings related to mutable GitHub Actions tags and a missing
min-release-agein.npmrc. Upgrades actions to their latest major versions, introduces runtime security hardening across all workflows, and adds Dependabot with cooldown periods to automate future dependency updates safely.Changes
GitHub Actions — pinned to commit SHAs and upgraded to latest majors:
actions/checkoutactions/setup-nodecodecov/codecov-actionactions/upload-artifactactions/download-artifactossf/scorecard-actiongithub/codeql-actionAll references are now immutable 40-character commit SHAs with version comments.
StepSecurity Harden Runner (v2.19.4):
egress-policy: auditto log outbound network connections without blocking.New
codeql.ymlworkflow (replacessemgrep.yml):.npmrc— supply-chain protection:min-release-age = 7— npm will refuse to resolve any package version published fewer than 7 days ago.Dependabot configuration (new
.github/dependabot.yml):min-release-age).npmandgithub-actionsecosystems.Breaking change notes for upgraded actions
pull_request_target/workflow_run— not used in this repo.Testing