fix(compliance): 2026-05-11 audit findings for .github repo#243
fix(compliance): 2026-05-11 audit findings for .github repo#243don-petry wants to merge 42 commits into
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
More reviews will be available in 55 minutes and 20 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe ChangesSecret Scan Job Update
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR remediates compliance-audit findings for the petry-projects/.github repository by adding the required CI secret scanning job and SHA-pinning an unpinned workflow action.
Changes:
- Added a
secret-scanjob to.github/workflows/ci.ymlusinggitleaks/gitleaks-action. - Pinned
dtolnay/rust-toolchain@stableto a full commit SHA in.github/workflows/dependency-audit.yml.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/ci.yml |
Adds a gitleaks-based secret scanning job to satisfy the required CI secret-scan check. |
.github/workflows/dependency-audit.yml |
Pins dtolnay/rust-toolchain to a specific commit SHA for action pinning compliance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Run gitleaks | ||
| uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9 | ||
| with: | ||
| args: detect --source . --redact --verbose --exit-code 1 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} |
|
@petry-projects/org-leads — all CI checks are green and the compliance fixes are in place. This PR is ready for your review and merge. Summary of what was fixed:
|
|
Auto-rebase failed — merge conflict — this branch has conflicts with Please resolve the conflicts and push: |
Fixes compliance findings for the .github repo from the 2026-05-11 audit: - ci.yml: add required gitleaks secret-scan job per push-protection standard - dependency-audit.yml: pin dtolnay/rust-toolchain@stable to commit SHA Also applied via GitHub API (no file changes needed): - Enabled CodeQL default setup (codeql-default-setup-not-configured) - Set allow_auto_merge=true, delete_branch_on_merge=true - Disabled check-suite auto-trigger for app IDs 1236702 (Claude) and 347564 (CodeRabbit) Note: unpinned-actions findings for agent-shield.yml, claude.yml, and dependabot-automerge.yml are false positives — internal reusable workflow refs are exempt from SHA pinning per ci-standards.md#exception-internal-reusable-workflow-references. Closes #241 Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
gitleaks-action v2 requires a license for organization repos. The GITLEAKS_LICENSE secret must be set in org secrets for this job to pass. Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
don-petry
force-pushed
the
claude/issue-241-20260511-1243
branch
from
8c8a04a to
33616ce
Compare
|
Auto-rebase blocked — the base branch contains Please rebase this branch manually: |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 4ba24363e633ef3213ef44dc74d5aab3a6341e96
Review mode: triage-approved (single reviewer)
Summary
Small, focused compliance fix (+21/-1 across 2 files) addressing audit findings from #241:
.github/workflows/ci.yml— adds asecret-scanjob usinggitleaks/gitleaks-actionto satisfy the required CI secret-scan check..github/workflows/dependency-audit.yml— pinsdtolnay/rust-toolchain@stableto commit SHA29eef336….
Remaining audit findings are addressed out-of-tree (CodeQL default setup, repo settings, check-suite auto-trigger) or documented as false positives / stale per the standards exception for internal reusable workflows.
Linked issue analysis
Closes #241 (2026-05-11 compliance audit). The PR description maps each audit finding to either an in-PR fix, an API-applied fix, a documented false positive (with link to the standards exception), or a noted platform limitation. Coverage of the issue is substantive.
Findings
None blocking. Spot checks:
- All third-party actions in the new job are SHA-pinned with version comments:
actions/checkout@de0fac2e… # v6.0.2,gitleaks/gitleaks-action@ff98106e… # v2.3.9. - New job permissions are minimal and appropriate (
contents: read,security-events: write). GITLEAKS_LICENSEis sourced from secrets (required for org repos on gitleaks-action v2), andGITHUB_TOKENis the standard scoped token — no secret leakage risk.- The rust-toolchain SHA pin replaces a floating
@stabletag, a strict supply-chain improvement. - No changes to auth, credentials, migrations, or other HIGH-risk surfaces.
CI status
All checks green on the reviewed SHA:
- CodeQL
Analyze (actions)— SUCCESS - CodeQL (overall) — SUCCESS
- CodeRabbit — SUCCESS
- SonarQube Cloud quality gate — passed (0 new issues)
Note: branch is currently BEHIND main and the auto-rebase bot reported it lacks workflows permission to merge in base updates; the author will need to rebase manually before merge, but this does not affect the correctness of the change.
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 83-101: The workflow contains a duplicate GitHub Actions job named
"secret-scan": keep the new gitleaks action-based job (the block starting with
the secret-scan job using gitleaks/gitleaks-action) and remove the stale
manual-install "secret-scan" job block (the earlier/manual-install variant
referenced in the review) so there is only one unique jobs: secret-scan
definition; delete the entire old manual-install secret-scan block to avoid YAML
key duplication and ensure the new action runs.
- Around line 95-101: Remove the unsupported args key from the gitleaks step and
instead pass flags and config via environment variables: delete the args: line
under the gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7
step, add env entries GITLEAKS_CONFIG: ".gitleaks.toml" to point to the existing
config file, and add GITLEAKS_ARGS: "detect --source . --redact --verbose
--exit-code 1" (preserving GITHUB_TOKEN and GITLEAKS_LICENSE) so the action
receives the same flags and loads the .gitleaks.toml allowlist and rules.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 311dcc96-b7fe-4ad9-98c8-822a38ca2bfc
📒 Files selected for processing (1)
.github/workflows/ci.yml
| - name: Run gitleaks | ||
| uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9 | ||
| with: | ||
| args: detect --source . --redact --verbose --exit-code 1 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# 1) Confirm gitleaks-action v2.3.9 has no `args` input.
curl -sSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/ff98106e4c7b2bc287b24eaf42907196329070c7/action.yml"
# 2) Check whether a .gitleaks.toml (or gitleaks.toml) is committed.
fd -HI -t f -a 'gitleaks\.toml$'Repository: petry-projects/.github
Length of output: 609
🏁 Script executed:
#!/bin/bash
# Fetch the full action.yml and search for inputs section
curl -sSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/ff98106e4c7b2bc287b24eaf42907196329070c7/action.yml" | head -100Repository: petry-projects/.github
Length of output: 575
🏁 Script executed:
#!/bin/bash
# Fetch the full action.yml without truncation
curl -sSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/ff98106e4c7b2bc287b24eaf42907196329070c7/action.yml"Repository: petry-projects/.github
Length of output: 575
🏁 Script executed:
#!/bin/bash
# Check if action.yml contains an inputs section
curl -sSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/ff98106e4c7b2bc287b24eaf42907196329070c7/action.yml" | grep -i "inputs"Repository: petry-projects/.github
Length of output: 48
🏁 Script executed:
#!/bin/bash
# Check the README for the action to confirm config file behavior
curl -sSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/ff98106e4c7b2bc287b24eaf42907196329070c7/README.md" | head -150Repository: petry-projects/.github
Length of output: 7944
Critical: args is not a recognized input for gitleaks/gitleaks-action@v2.
The action's action.yml declares no inputs: section—configuration is taken entirely from environment variables. The args: detect --source . --redact --verbose --exit-code 1 will be silently ignored, losing flags like --redact and --verbose.
Additionally, the action auto-detects only gitleaks.toml (without dot prefix) at the repo root. A .gitleaks.toml file exists in this repo but will not be loaded; its allowlist and custom rules will be silently dropped unless explicitly set via GITLEAKS_CONFIG.
🛠 Fix — remove unsupported `args` and wire config via env
- name: Run gitleaks
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
- with:
- args: detect --source . --redact --verbose --exit-code 1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+ GITLEAKS_CONFIG: .gitleaks.toml🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 95 - 101, Remove the unsupported args
key from the gitleaks step and instead pass flags and config via environment
variables: delete the args: line under the
gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 step, add env
entries GITLEAKS_CONFIG: ".gitleaks.toml" to point to the existing config file,
and add GITLEAKS_ARGS: "detect --source . --redact --verbose --exit-code 1"
(preserving GITHUB_TOKEN and GITLEAKS_LICENSE) so the action receives the same
flags and loads the .gitleaks.toml allowlist and rules.
Superseded by automated re-review at
|
donpetry-bot
dismissed
their stale review
Superseded by automated re-review at ee01ab7.
Review — fix requested (cycle 3/3)The automated review identified the following issues. Please address each one: Findings to fix[Findings would be inserted here] Additional tasks
The review cascade will automatically re-review after new commits are pushed. |
|
@dev-lead - please fix this PR |
|
Summary
Fixes the compliance audit findings for the
.githubrepository from the 2026-05-11 audit.Changes in this PR
ci.yml: Added requiredsecret-scanjob usinggitleaks/gitleaks-action(fixessecret_scan_ci_job_present)dependency-audit.yml: Pinneddtolnay/rust-toolchain@stableto commit SHA29eef336(fixesunpinned-actions-dependency-audit.yml)Applied via GitHub API (no file changes)
PATCH /repos/petry-projects/.github/code-scanning/default-setup(fixescodeql-default-setup-not-configured)allow_auto_merge=trueanddelete_branch_on_merge=true(fixes those warnings)check-suite-auto-trigger-*errors)False Positives — No Action Needed
The following findings from the audit are false positives per the Exception in
ci-standards.md#exception-internal-reusable-workflow-references:unpinned-actions-agent-shield.yml— uses@v1(internal reusable, exempt)unpinned-actions-claude.yml— uses@main(internal reusable, exempt)unpinned-actions-dependabot-automerge.yml— uses@v1(internal reusable, exempt)SHA-pinning these would cause OIDC token validation failures for Claude Code.
Stale Findings — Already Compliant
codeowners-org-leads-not-firstandcodeowners-no-catchall— CODEOWNERS already has* @petry-projects/org-leads. These appear to be stale from before a recent fix.Out of Scope (Platform Limitation)
security_and_analysis_unavailable— token lacks admin scope to read/setsecurity_and_analysisflags (free-plan repos). Warning only.Closes #241
Generated with Claude Code
Summary by CodeRabbit