Skip to content

Commit a341fe9

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
Review SCM files and security updates (#6)
## Security Hardening - Pin all GitHub Actions to full 40-character commit SHAs - Remove @main/@master references (security risk) - Update actions to latest stable versions with SHA pins ## Files Updated - All 13 workflow files in .github/workflows/ - security.txt: Extend expiration to 2026-12-31 - SECURITY.md: Fix license info (dual MIT/AGPL), update date ## SCM Files - STATE.scm: Updated roadmap with security milestone - META.scm: Fixed languages (racket, powershell, bash, guile) - ECOSYSTEM.scm: Converted to valid Guile module syntax - guix.scm: Updated to v0.2.0, added dual license ## RSR Gold Compliance - SHA-pinned actions per RSR security requirements - SPDX headers updated where needed - License consistency across all documentation # Pull Request ## Description <!-- Provide a brief description of the changes in this PR --> ## Type of Change <!-- Mark the relevant option with an "x" --> - [ ] Bug fix (non-breaking change that fixes an issue) - [ ] New feature (non-breaking change that adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update - [ ] Code refactoring - [ ] Performance improvement - [ ] Test addition/improvement - [ ] CI/CD improvement - [ ] Dependency update ## Related Issues <!-- Link to related issues using #issue-number --> Fixes # Relates to # ## Changes Made <!-- List the specific changes made in this PR --> - - - ## Testing Performed <!-- Describe the testing you've done --> ### Manual Testing - [ ] Tested on Windows - [ ] Tested on Linux - [ ] Tested on macOS - [ ] Tested PowerShell scaffolder - [ ] Tested Racket scaffolder - [ ] Tested Bash scaffolder - [ ] Tested all template types (practitioner, researcher, student) ### Automated Testing - [ ] All existing tests pass - [ ] New tests added for new functionality - [ ] Test coverage maintained or improved **Test Output:** ``` <!-- Paste test output here if relevant --> ``` ## Documentation - [ ] README.md updated (if needed) - [ ] CONTRIBUTING.md updated (if needed) - [ ] CLAUDE.md updated (if needed) - [ ] CHANGELOG.md updated - [ ] Code comments added/updated - [ ] Template documentation updated (if templates changed) ## Screenshots / Examples <!-- Add screenshots or example output if applicable --> ## Breaking Changes <!-- If this PR includes breaking changes, list them here with migration instructions --> None OR - **Change 1**: Description and migration path - **Change 2**: Description and migration path ## Checklist <!-- Mark completed items with an "x" --> ### Code Quality - [ ] Code follows the project's style guidelines - [ ] Self-review of code performed - [ ] Comments added for complex/non-obvious code - [ ] No new warnings generated - [ ] Code is DRY (Don't Repeat Yourself) ### Testing - [ ] All tests pass locally - [ ] New tests added as appropriate - [ ] Edge cases considered and tested - [ ] No existing functionality broken ### Documentation - [ ] Documentation updated as needed - [ ] All new functions/methods documented - [ ] README examples work correctly - [ ] Commit messages are clear and descriptive ### Security - [ ] No sensitive information (passwords, keys, etc.) in code - [ ] Input validation added where appropriate - [ ] No new security vulnerabilities introduced - [ ] Dependencies are up-to-date and secure ## Additional Notes <!-- Any additional information reviewers should know --> ## Reviewer Guidance <!-- Help reviewers by pointing out specific areas that need attention --> Please pay special attention to: - - ## Post-Merge Actions <!-- List any actions that need to be taken after merging --> - [ ] Update related documentation - [ ] Announce changes to users - [ ] Create release notes - [ ] Other: --- **For Maintainers:** - [ ] PR title follows conventional commits format - [ ] Labels applied correctly - [ ] Milestone set (if applicable) - [ ] Linked to project board (if applicable) Signed-off-by: Claude Code <claude@anthropic.com> Co-authored-by: Claude <noreply@anthropic.com>
1 parent 0e428f5 commit a341fe9

19 files changed

+149
-124
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818

1919
steps:
2020
- name: Checkout code
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2222

2323
- name: Setup PowerShell
2424
shell: pwsh
@@ -170,7 +170,7 @@ jobs:
170170
171171
- name: Upload test artifacts
172172
if: always()
173-
uses: actions/upload-artifact@v4
173+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
174174
with:
175175
name: test-projects-${{ matrix.os }}
176176
path: |
@@ -191,10 +191,10 @@ jobs:
191191

192192
steps:
193193
- name: Checkout code
194-
uses: actions/checkout@v4
194+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
195195

196196
- name: Setup Racket
197-
uses: Bogdanp/setup-racket@v1.10
197+
uses: Bogdanp/setup-racket@fda0f4d167468421766cea8a36140bd2c3c3450d # v1.14
198198
with:
199199
version: ${{ matrix.racket-version }}
200200
distribution: 'full'
@@ -233,7 +233,7 @@ jobs:
233233
234234
- name: Upload Racket test artifacts
235235
if: always()
236-
uses: actions/upload-artifact@v4
236+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
237237
with:
238238
name: test-racket-projects-${{ matrix.os }}-${{ matrix.racket-version }}
239239
path: |
@@ -251,7 +251,7 @@ jobs:
251251

252252
steps:
253253
- name: Checkout code
254-
uses: actions/checkout@v4
254+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
255255

256256
- name: Run Bash tests
257257
run: |
@@ -272,7 +272,7 @@ jobs:
272272
273273
- name: Upload Bash test artifacts
274274
if: always()
275-
uses: actions/upload-artifact@v4
275+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
276276
with:
277277
name: test-bash-projects-${{ matrix.os }}
278278
path: BashTestProject/
@@ -284,7 +284,7 @@ jobs:
284284

285285
steps:
286286
- name: Checkout code
287-
uses: actions/checkout@v4
287+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
288288

289289
- name: Install PSScriptAnalyzer
290290
shell: pwsh
@@ -311,10 +311,10 @@ jobs:
311311

312312
steps:
313313
- name: Checkout code
314-
uses: actions/checkout@v4
314+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
315315

316316
- name: Setup Racket
317-
uses: Bogdanp/setup-racket@v1.10
317+
uses: Bogdanp/setup-racket@fda0f4d167468421766cea8a36140bd2c3c3450d # v1.14
318318
with:
319319
version: '8.12'
320320
distribution: 'full'
@@ -330,10 +330,10 @@ jobs:
330330

331331
steps:
332332
- name: Checkout code
333-
uses: actions/checkout@v4
333+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
334334

335335
- name: Check for broken links in README
336-
uses: gaurav-nelson/github-action-markdown-link-check@v1
336+
uses: gaurav-nelson/github-action-markdown-link-check@3c3b66f1f7d0900e37b71eca45b63ea9eedfce31 # v1.0.17
337337
with:
338338
use-quiet-mode: 'yes'
339339
config-file: '.github/workflows/markdown-link-check-config.json'
@@ -359,18 +359,18 @@ jobs:
359359

360360
steps:
361361
- name: Checkout code
362-
uses: actions/checkout@v4
362+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
363363

364364
- name: Run Trivy security scanner
365-
uses: aquasecurity/trivy-action@master
365+
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
366366
with:
367367
scan-type: 'fs'
368368
scan-ref: '.'
369369
format: 'sarif'
370370
output: 'trivy-results.sarif'
371371

372372
- name: Upload Trivy results to GitHub Security
373-
uses: github/codeql-action/upload-sarif@v3
373+
uses: github/codeql-action/upload-sarif@45c373516f557556c15d420e3f5e0aa3d64366bc # v3.31.9
374374
if: always()
375375
with:
376376
sarif_file: 'trivy-results.sarif'
@@ -384,7 +384,7 @@ jobs:
384384

385385
steps:
386386
- name: Checkout code
387-
uses: actions/checkout@v4
387+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
388388

389389
- name: Test file path handling
390390
shell: pwsh
@@ -410,10 +410,10 @@ jobs:
410410

411411
steps:
412412
- name: Checkout code
413-
uses: actions/checkout@v4
413+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
414414

415415
- name: Setup Node.js
416-
uses: actions/setup-node@v4
416+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
417417
with:
418418
node-version: '20'
419419

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@ jobs:
3232

3333
steps:
3434
- name: Checkout repository
35-
uses: actions/checkout@v4
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3636

3737
- name: Initialize CodeQL
38-
uses: github/codeql-action/init@v3
38+
uses: github/codeql-action/init@45c373516f557556c15d420e3f5e0aa3d64366bc # v3.31.9
3939
with:
4040
languages: ${{ matrix.language }}
4141
build-mode: ${{ matrix.build-mode }}
@@ -45,6 +45,6 @@ jobs:
4545
echo 'Build step for compiled languages'
4646
4747
- name: Perform CodeQL Analysis
48-
uses: github/codeql-action/analyze@v3
48+
uses: github/codeql-action/analyze@45c373516f557556c15d420e3f5e0aa3d64366bc # v3.31.9
4949
with:
5050
category: "/language:${{matrix.language}}"

‎.github/workflows/codeql.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,18 @@ jobs:
2424

2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@v4
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2828

2929
- name: Initialize CodeQL
30-
uses: github/codeql-action/init@v3
30+
uses: github/codeql-action/init@45c373516f557556c15d420e3f5e0aa3d64366bc # v3.31.9
3131
with:
3232
languages: ${{ matrix.language }}
3333
queries: security-extended,security-and-quality
3434

3535
- name: Autobuild
36-
uses: github/codeql-action/autobuild@v3
36+
uses: github/codeql-action/autobuild@45c373516f557556c15d420e3f5e0aa3d64366bc # v3.31.9
3737

3838
- name: Perform CodeQL Analysis
39-
uses: github/codeql-action/analyze@v3
39+
uses: github/codeql-action/analyze@45c373516f557556c15d420e3f5e0aa3d64366bc # v3.31.9
4040
with:
4141
category: "/language:${{ matrix.language }}"

‎.github/workflows/comprehensive-quality.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
dependability:
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: actions/checkout@v4
14+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1515
- name: Check test coverage
1616
run: |
1717
echo "Checking for test files..."
@@ -30,9 +30,9 @@ jobs:
3030
security:
3131
runs-on: ubuntu-latest
3232
steps:
33-
- uses: actions/checkout@v4
33+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3434
- name: Secret scanning
35-
uses: trufflesecurity/trufflehog@main
35+
uses: trufflesecurity/trufflehog@cedc4dd3e21158fbf4d426a9a2e61e5e1adc5cdb # v3.88.3
3636
continue-on-error: true
3737
- name: Dependency vulnerabilities
3838
run: |
@@ -43,14 +43,14 @@ jobs:
4343
pip install safety && safety check -r requirements.txt || true
4444
fi
4545
- name: SAST scan
46-
uses: returntocorp/semgrep-action@v1
46+
uses: returntocorp/semgrep-action@713efdd345f3b9c89e01adc14f2b8e6f81876fc2 # v1
4747
continue-on-error: true
4848

4949
# INTEROPERABILITY - API and format compatibility
5050
interoperability:
5151
runs-on: ubuntu-latest
5252
steps:
53-
- uses: actions/checkout@v4
53+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5454
- name: Check API specs
5555
run: |
5656
if [ -f "openapi.yaml" ] || [ -f "openapi.json" ]; then
@@ -67,7 +67,7 @@ jobs:
6767
validation:
6868
runs-on: ubuntu-latest
6969
steps:
70-
- uses: actions/checkout@v4
70+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7171
- name: Check for validation patterns
7272
run: |
7373
VALIDATION=$(grep -rE "validate|sanitize|Schema|Validator" --include="*.rs" --include="*.res" --include="*.ex" . 2>/dev/null | wc -l || echo "0")
@@ -81,7 +81,7 @@ jobs:
8181
contents: read
8282
attestations: write
8383
steps:
84-
- uses: actions/checkout@v4
84+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8585
- name: Generate SBOM
8686
run: |
8787
echo "SBOM generation would run here"
@@ -97,7 +97,7 @@ jobs:
9797
verification:
9898
runs-on: ubuntu-latest
9999
steps:
100-
- uses: actions/checkout@v4
100+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
101101
- name: Check SPARK proofs
102102
run: |
103103
if find . -name "*.ads" | grep -q .; then
@@ -113,7 +113,7 @@ jobs:
113113
functionality:
114114
runs-on: ubuntu-latest
115115
steps:
116-
- uses: actions/checkout@v4
116+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
117117
- name: Check TODOs and FIXMEs
118118
run: |
119119
echo "=== Incomplete items ==="
@@ -126,7 +126,7 @@ jobs:
126126
performance:
127127
runs-on: ubuntu-latest
128128
steps:
129-
- uses: actions/checkout@v4
129+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
130130
- name: Check for benchmarks
131131
run: |
132132
BENCHES=$(find . -name "*bench*" -o -name "*perf*" | wc -l)
@@ -143,7 +143,7 @@ jobs:
143143
runs-on: ubuntu-latest
144144
if: hashFiles('**/*.html') != ''
145145
steps:
146-
- uses: actions/checkout@v4
146+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
147147
- name: HTML accessibility check
148148
run: |
149149
echo "Checking for a11y attributes..."
@@ -157,7 +157,7 @@ jobs:
157157
license:
158158
runs-on: ubuntu-latest
159159
steps:
160-
- uses: actions/checkout@v4
160+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
161161
- name: Check license files
162162
run: |
163163
if [ -f "LICENSE" ] || [ -f "LICENSE.txt" ] || [ -f "LICENSE.md" ]; then
@@ -175,7 +175,7 @@ jobs:
175175
documentation:
176176
runs-on: ubuntu-latest
177177
steps:
178-
- uses: actions/checkout@v4
178+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
179179
- name: Check docs completeness
180180
run: |
181181
DOCS=""

‎.github/workflows/guix-nix-policy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ jobs:
44
check:
55
runs-on: ubuntu-latest
66
steps:
7-
- uses: actions/checkout@v4
7+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
88
- name: Enforce Guix primary / Nix fallback
99
run: |
1010
# Check for package manager files

‎.github/workflows/jekyll-gh-pages.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,16 +27,16 @@ jobs:
2727
runs-on: ubuntu-latest
2828
steps:
2929
- name: Checkout
30-
uses: actions/checkout@v4
30+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3131
- name: Setup Pages
32-
uses: actions/configure-pages@v5
32+
uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
3333
- name: Build with Jekyll
34-
uses: actions/jekyll-build-pages@v1
34+
uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1.0.13
3535
with:
3636
source: ./
3737
destination: ./_site
3838
- name: Upload artifact
39-
uses: actions/upload-pages-artifact@v3
39+
uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
4040

4141
# Deployment job
4242
deploy:
@@ -48,4 +48,4 @@ jobs:
4848
steps:
4949
- name: Deploy to GitHub Pages
5050
id: deployment
51-
uses: actions/deploy-pages@v4
51+
uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5

0 commit comments

Comments
 (0)