fix(security): remediate open Scorecard code-scanning alerts - #305
fix(security): remediate open Scorecard code-scanning alerts#305seonghobae wants to merge 4 commits into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
OpenCode Review Overview
Pull request overviewOpenCode reviewed the current-head bounded evidence and found no blocking issues. FindingsNo blocking findings. SummaryNo changes in the PR. Coverage: not applicable. Verification posture: no changes to verify. Security/privacy: no changes. Implementation completeness: not applicable. DAG: no changes. TDD/regression: not applicable. Docstring coverage: not applicable. Compatibility/convention: no changes. Developer experience: no changes. User experience: no changes. Accessibility/i18n: no changes. Supply-chain/license: no changes. Packaging: no changes. Performance: no changes. Visual/DOM: no changes. Standards search: not needed. Claim/concept check: not needed. Similar issues: not found. CDD/context: no changes. DDD/domain: no changes. PoC/execution: not needed. Linter/static: not needed.
Changed-File Evidence Mapflowchart LR
Evidence["OpenCode evidence"] --> Review["Current PR review path"]
Review --> Verify["Required checks"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/build-ci-image.yml, tests/test_docker_delivery.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/build-ci-image.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: Security fixes with full test coverage and no unresolved issues
- Head SHA:
46f3b12fb2cd0b138cc218aa434b7786440eee71 - Workflow run: 29085677067
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: build-ci-image.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: build-ci-image.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: Dockerfile.test"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: Dockerfile.test"]
R2 --> V2["required checks"]
Evidence --> S3["Test: test_docker_delivery.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_docker_delivery.py"]
R3 --> V3["targeted test run"]
Address two OpenSSF Scorecard code-scanning findings on the default branch: - alert #39 (TokenPermissionsID, high) build-ci-image.yml: drop the top-level `packages: write` and grant it only to the build-and-push job, leaving a read-only GITHUB_TOKEN default at the workflow level (least privilege). - alert #41 (PinnedDependenciesID) Dockerfile.test: pin the python:3.10-slim base image to its multi-arch manifest-list digest so the build image is reproducible and tamper-evident. Both alerts auto-close once this lands on develop. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RTAMs4bpSZS77Xe3RQjv9P
Dockerfile.test ran as root, which Trivy code scanning flags as DS-0002 (image user should not be root, high severity). Pinning the base image by digest in this PR re-anchored the pre-existing misconfig to the changed FROM line, surfacing it as a new alert and failing the Trivy check. Add an unprivileged 'ciuser', chown the workdir to it so pytest can write its cache/coverage artifacts, and switch to USER ciuser. The image is run via 'docker run' (CMD pytest) and is not used as a GitHub Actions container: job, so root is not required for runner bind mounts.
1cd9f24 to
87c4d21
Compare
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/build-ci-image.yml, tests/test_docker_delivery.py.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/build-ci-image.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
- Result: APPROVE
- Reason: Security fixes pass all verification gates
- Head SHA:
87c4d2104a5a735bdc48811eda86b3b16c7d7e89 - Workflow run: 29136424513
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: build-ci-image.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: build-ci-image.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: Dockerfile.test"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: Dockerfile.test"]
R2 --> V2["required checks"]
Evidence --> S3["Test: test_docker_delivery.py"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test: test_docker_delivery.py"]
R3 --> V3["targeted test run"]
|
자동 정리: base 대비 실제 변경(diff)이 0건이라 이 PR을 닫습니다. 변경을 추가한 뒤 reopen하세요. |
Pull request was closed
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
No changes in the PR. Coverage: not applicable. Verification posture: no changes to verify. Security/privacy: no changes. Implementation completeness: not applicable. DAG: no changes. TDD/regression: not applicable. Docstring coverage: not applicable. Compatibility/convention: no changes. Developer experience: no changes. User experience: no changes. Accessibility/i18n: no changes. Supply-chain/license: no changes. Packaging: no changes. Performance: no changes. Visual/DOM: no changes. Standards search: not needed. Claim/concept check: not needed. Similar issues: not found. CDD/context: no changes. DDD/domain: no changes. PoC/execution: not needed. Linter/static: not needed.
- Result: APPROVE
- Reason: No changes in the PR
- Head SHA:
ba434127e98cde8130cdc4bcd146104c140dd7d5 - Workflow run: 29151577031
- Workflow attempt: 1
Changed-File Evidence Map
flowchart LR
Evidence["OpenCode evidence"] --> Review["Current PR review path"]
Review --> Verify["Required checks"]
2 participants
Summary
Remediates the fixable-in-code OpenSSF Scorecard alerts on the Security tab of
ContextualWisdomLab/newsdom-api. Both alerts auto-close once this merges intodevelop(the analyzed default branch).Fixes
Alert fix: harden workflow attestation and fuzz builder paths #39 —
TokenPermissionsID(high),.github/workflows/build-ci-image.ymlScorecard: "topLevel 'packages' permission set to 'write'". Moved
packages: writefrom the workflow-levelpermissions:block down to the singlebuild-and-pushjob that pushes to GHCR, leaving the top-levelGITHUB_TOKENread-only. Least-privilege; build/push behavior is unchanged.Alert Track legacy markdownlint debt in historical planning docs #41 —
PinnedDependenciesID(medium),Dockerfile.testScorecard: "containerImage not pinned by hash". Pinned
python:3.10-slimto its current multi-arch manifest-list digest (sha256:e5300dc0…27dd4), resolved live from the Docker registry, so the CI base image is reproducible and tamper-evident. The tag is retained alongside the digest for readability.Not changed in this PR (triaged)
TokenPermissionsID,release.yml:17(jobLevel 'contents' permission set to 'write') —contents: writeis the minimum required for the release job to publish GitHub releases (gh release create/upload) and is already scoped to that one job. Dismissed as won't fix via the code-scanning API (required permission, not weakened).🤖 Generated with Claude Code