Repository navigation
security: harden CI workflows and document trust boundaries - #44
Merged
Merged
Conversation
rahulcrl
force-pushed
the
harden_ci_and_security_docs
branch
from
July 16, 2026 11:59
cfb9e52 to
aa7b249
Compare
rahulcrl
marked this pull request as ready for review
July 16, 2026 12:00
emnet-crl
approved these changes
Jul 16, 2026
SHA-pin all GitHub Actions in the CI and release workflows so a moved or compromised tag cannot inject code into CI or published artifacts. Gate the AI PR review job to same-repo branches since pull_request_target runs with base-repo secrets on fork PRs, and pin its reusable workflow to a commit. Annotate the read tools with the MCP read-only hint so clients can gate human-in-the-loop confirmation on the mutating tools only. Document in the README that the connecting SQL role is the security boundary, with a least-privilege role recipe, and describe the prompt-injection exposure inherent to tool-using agents. Bump the Go directive to 1.26 to spell the destructive hints as new(true) instead of a pointer-to-local.
rahulcrl
force-pushed
the
harden_ci_and_security_docs
branch
from
July 17, 2026 06:09
aa7b249 to
84f481b
Compare
Contributor
Author
|
TFTR @emnet-crl! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pre-public-release security hardening across the workflows, tool annotations, and README.
ci.yamlandrelease.yaml, with trailing version comments.release.yamlis the priority target since it holdscontents: writeandid-token: write. Dependabot (already watchinggithub-actions) keeps the pins fresh.pull_request_targetruns with base-repo secrets, so on a public repo any fork PR could fire it; fork PRs can still be reviewed viaworkflow_dispatch. The roachdev reusable workflow is pinned to a commit SHA. Verified it never checks out untrusted PR head code (diff is fetched as data only).secrets: inheritmust stay until roachdev declares the token it uses inworkflow_call. Note:review.ymlis managed byroachdev codereview, so a regen could overwrite the gate.ReadOnlyHint: true(the MCP default is false) so clients can reserve human-in-the-loop confirmation for the mutating tools.insert_rowsand the create tools stay unannotated on purpose: the spec defaults destructive to true, andINSERT ... ON CONFLICTcan mutate. Bumps Go to 1.26 to spell the destructive hints asnew(true).Testing
go build,go vet, andgo test ./...all clean;TestRegisterToolsGatingextended with subtests asserting read tools hint read-only, write tools never do, and the row mutation tools hint destructive.