Skip to content

Commit dd28b36

Browse files
shahariaazamVibeXP Botclaude
authored
feat: central enforcement — SECURITY.md, hardened workflow template, dependabot (#2)
Implements the `shaharia-lab/.github` half of Task F from infrastructure#168 — tracked in infrastructure#171. The org security defaults, Actions allowlist, and branch protection already landed in the `infrastructure` repo. This activates the `.github` org repo for the central pieces that live here. ## Changes - **`SECURITY.md`** — org-wide vulnerability disclosure policy. As a community health file in `.github`, it's inherited by every repo that doesn't define its own, including private-vulnerability-reporting guidance and leaked-credential handling. - **`workflow-templates/go-ci.yml`** (+ `.properties.json`) — a hardened, **SHA-pinned** Go CI starter that shows up as a "starter workflow" when creating workflows in any org repo: - top-level `permissions: { contents: read }` (least-privilege `GITHUB_TOKEN`) - `step-security/harden-runner` in `audit` mode (egress visibility; flip to `block` later) - lint (golangci-lint) + `go test -race -mod=readonly` - every action pinned by full commit SHA, reusing the pins already vetted in `vibexp.io`/infra CI. - **`.github/dependabot.yml`** — `github-actions` ecosystem, weekly, `open-pull-requests-limit: 5`, **no auto-merge**. ## Correctness note for reviewers A `dependabot.yml` in `.github` does **not** propagate org-wide — unlike community health files, it only configures *this* repo. New repos still get Dependabot **alerts** automatically (org default set in infra IaC), but Dependabot **version-update PRs** require a per-repo `dependabot.yml`. The file here is documented as the copy-paste reference; the real new-repo mechanism is the `workflow-templates/` starter. ## Scope deliberately kept small One Go template (the org's dominant language). Rust/Node/Python templates and converting `actions-library` into the shared reusable-workflow source (infrastructure#172) are separate follow-ups. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: VibeXP Bot <bot@vibexp.io> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 70f46ab commit dd28b36

4 files changed

Lines changed: 116 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Dependabot config for the .github repo ITSELF.
2+
#
3+
# NOTE: GitHub does NOT propagate dependabot.yml org-wide — unlike community
4+
# health files (SECURITY.md, etc.), a dependabot.yml only configures the repo it
5+
# lives in. New repos pick up Dependabot ALERTS automatically (org default, set
6+
# in the infrastructure IaC), but to get Dependabot version-update PRs each repo
7+
# must add its own dependabot.yml. Use the block below as the copy-paste
8+
# reference; the hardened starter workflow lives in ../workflow-templates/.
9+
version: 2
10+
updates:
11+
- package-ecosystem: "github-actions"
12+
directory: "/"
13+
schedule:
14+
interval: "weekly"
15+
open-pull-requests-limit: 5
16+
# Do NOT auto-merge github-actions updates: a malicious or compromised
17+
# digest bump must be reviewed by a human (re-pinning is only as safe as the
18+
# review of the bump). Auto-merge is acceptable for trusted lib patch bumps,
19+
# never for Actions.
20+
commit-message:
21+
prefix: "chore(actions)"

‎SECURITY.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Security Policy
2+
3+
This policy applies to all repositories in the [`shaharia-lab`](https://github.com/shaharia-lab)
4+
organization. It lives in the `.github` repository so it is inherited by every
5+
repo that does not define its own `SECURITY.md`.
6+
7+
## Reporting a vulnerability
8+
9+
**Please do not open public issues for security vulnerabilities.**
10+
11+
Report privately via one of:
12+
13+
1. **GitHub private vulnerability reporting** — on the affected repository, go to
14+
the **Security** tab → **Report a vulnerability** (preferred; keeps the report
15+
attached to the repo).
16+
2. **Email** — [hello@shaharialab.com](mailto:hello@shaharialab.com) with the
17+
subject prefixed `[SECURITY]`.
18+
19+
Please include:
20+
21+
- the affected repository and version / commit,
22+
- a description of the issue and its impact,
23+
- reproduction steps or a proof of concept, and
24+
- any suggested remediation, if known.
25+
26+
## What to expect
27+
28+
- **Acknowledgement** within 5 business days.
29+
- An initial assessment and severity triage shortly after.
30+
- Coordinated disclosure: we will agree a disclosure timeline with you and credit
31+
you (if you wish) once a fix is released.
32+
33+
## Scope
34+
35+
In scope: source code, CI/CD workflows, and infrastructure-as-code in
36+
`shaharia-lab` repositories. Out of scope: third-party services we depend on
37+
(report those to the respective vendor) and findings that require privileged
38+
access already granted to you.
39+
40+
## Handling of leaked credentials
41+
42+
If you discover a credential (API key, token, private key) committed to any
43+
repository, treat it as live: report it privately as above and **do not** use it.
44+
Rotation at the source is our first response; history cleanup is secondary.

‎workflow-templates/go-ci.properties.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"name": "Go CI (hardened, shaharia-lab)",
3+
"description": "SHA-pinned lint + test with least-privilege permissions and harden-runner egress audit.",
4+
"categories": ["Go", "Continuous integration"],
5+
"filePatterns": ["go.mod$"]
6+
}

‎workflow-templates/go-ci.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Hardened Go CI starter (shaharia-lab).
2+
#
3+
# Conventions enforced here (see GITHUB_SECURITY.md in the infrastructure repo):
4+
# - every action is pinned by full commit SHA (mutable tags are an attack vector)
5+
# - least-privilege GITHUB_TOKEN: read-only at the top level
6+
# - step-security/harden-runner in `audit` mode (flip to `block` once the
7+
# egress allowlist is known) — neutralises runner-side exfiltration
8+
#
9+
# When Dependabot/Renovate bumps these action digests, REVIEW them — never
10+
# auto-merge github-actions updates.
11+
name: CI
12+
13+
on:
14+
push:
15+
branches: ["$default-branch"]
16+
pull_request:
17+
branches: ["$default-branch"]
18+
19+
permissions:
20+
contents: read
21+
22+
jobs:
23+
lint:
24+
runs-on: ubuntu-latest
25+
steps:
26+
- uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
27+
with:
28+
egress-policy: audit
29+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
31+
with:
32+
go-version: stable
33+
- uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
34+
35+
test:
36+
runs-on: ubuntu-latest
37+
steps:
38+
- uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
39+
with:
40+
egress-policy: audit
41+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
42+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
43+
with:
44+
go-version: stable
45+
- run: go test -race -mod=readonly ./...

0 commit comments

Comments
 (0)