GitHub practice re-check 2026-09-25: Actions allow-list (selected), dated SOTA comparison, drift recorded

[seathatflowsinourveins]

Scope and base

• Lane: lane:foundation. This re-checks our GitHub practice against current primary sources (2026-09-25) and closes the one real policy gap.
• Base: rebased onto origin/main at the time of the hot-file commit.
• What was already current (verified, nothing to change): every action pin is on its current release (checkout v7.0.1, codeql-action v4.38.1, scorecard-action v2.4.4, harden-runner v2.21.1, attest v4.2.2, zizmor 1.30.1). The Node 20 removal on 2026-09-23 does not affect any of them. No workflow uses pull_request_target or workflow_run. Dependabot's 7-day cooldown is at least the new 3-day default. The 3 rulesets match the committed JSON exactly.

What changes

• .github/actions-permissions.json (new): the committed Actions policy.
  • allowed_actions: selected: GitHub-owned actions plus step-security/harden-runner@* and ossf/scorecard-action@*.
  • verified_allowed: false.
  • sha_pinning_required: true.
  • Workflow permissions stay at default read. can_approve_pull_request_reviews stays true, because catalog-freshness propose must open PRs and required approvals are 0 (see the approval guard in 2026-09-23-bot-pr-dispatch.md).
  • Fork approval: all_external_contributors.
• tests/test_workflow_hardening.py: ActionsAllowListTests fails CI offline if any workflow uses: falls outside that policy.
• docs/decisions/2026-09-22-github-automation-closure.md: a new section, "2026-09-25 re-check against current practice", recording:
  • the source comparison;
  • the adoption of the allow-list, with its after-GET and rollback;
  • the fork-approval after-GET, which closes a pending step;
  • read-back ownership: private agent-ecosystem github_settings.py observe mode;
  • Scorecard structural alerts accepted, each with an overturn: Code-Review and Branch-Protection need a second human; Maintained depends on repo age; Fuzzing → the property-based-testing skill trial; CII badge = an optional owner step;
  • SLSA v1.2 Source L3 as the target (L4 needs two humans);
  • dated non-adoptions: merge queue, code_quality/code_coverage, required_reviewers, secret-alert-resolution, partner validity checks, Copilot-only rules;
  • the §8 pip-graph status.
• docs/github-automation.md: the stale "Ruleset upgrade, 2026-09-22" text is marked superseded, and the fork-approval wording is replaced with the dated after-GET.

Live change (applied by the coordinator, owner gh)

• Before-GET, 2026-09-25T22:56:28Z: {"enabled":true,"allowed_actions":"all","sha_pinning_required":true}. selected-actions answered 409.
• PUT of actions/permissions and actions/permissions/selected-actions, taken from the committed JSON.
• After-GET, 22:56:29Z: allowed_actions: selected, sha_pinning_required: true, github_owned_allowed: true, verified_allowed: false, patterns_allowed as committed. Workflow permissions read / true. Fork approval all_external_contributors.
• Confirmation on main after the change, as a peer session asked:
  • token-report (harden-runner): success, https://github.com/seathatflowsinourveins/native-agent-stack/actions/runs/36198993979
  • scorecard (harden-runner + ossf/scorecard-action): success, https://github.com/seathatflowsinourveins/native-agent-stack/actions/runs/36198995108
• Read-back: agent-ecosystem scripts/github_settings.py --check → native-agent-stack/actions-selected-actions: pass, actions-sha-pinning: pass, overall ok: true. This is the companion agent-ecosystem PR.
• Rollback: gh api --method PUT repos/seathatflowsinourveins/native-agent-stack/actions/permissions -f allowed_actions=all -F enabled=true -F sha_pinning_required=true.

SOTA sources

• GitHub REST, "Set GitHub Actions permissions for a repository" and "Set allowed actions and reusable workflows": https://docs.github.com/en/rest/actions/permissions
• GitHub changelog:
  • SHA pinning + blocking actions: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
  • default setup under restrictive policies: https://github.blog/changelog/2025-11-25-code-scanning-default-setup-bypasses-github-actions-policy-blocks/
  • Dependabot default cooldown: https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/
  • Code Quality GA: https://github.blog/changelog/2026-07-20-github-code-quality-is-now-generally-available/
  • secret-alert rule, public preview: https://github.blog/changelog/2026-09-09-block-pull-requests-with-exposed-secrets-from-merging/
  • required-reviewer rule: https://github.blog/changelog/2026-02-17-required-reviewer-rule-is-now-generally-available/
• Merge queue availability: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue
• OpenSSF Scorecard checks: https://github.com/ossf/scorecard/blob/main/docs/checks.md (scorecard-action v2.4.4). SLSA v1.2 Source track: https://slsa.dev/spec/v1.2/source-requirements. zizmor 1.30.1 audits: https://docs.zizmor.sh/audits/
• The read-back reuses the existing private agent-ecosystem scripts/github_settings.py observe mode; no new checker.

Evidence-class table

Claim	Class
Live settings before and after	native_proven (read-only GET, owner gh)
Allow-list lets real runs through	native_proven (2 successful workflow_dispatch runs on main)
Every workflow uses: is allowed	offline test (ActionsAllowListTests)
Current-practice comparison	primary-source review (GitHub changelog and docs, OpenSSF Scorecard, SLSA v1.2, zizmor), dated 2026-09-25

Commands run

gh api repos/seathatflowsinourveins/native-agent-stack/actions/permissions            # before / after
gh api --method PUT .../actions/permissions --input <from .github/actions-permissions.json>
gh api --method PUT .../actions/permissions/selected-actions --input <same>
gh workflow run token-report.yml --ref main ; gh workflow run scorecard.yml --ref main  # both success
uv run --no-project --with jsonschema --with pyyaml python -m unittest discover -s tests -p "test_workflow*.py"   # 66 OK
python3 scripts/validate.py                                                             # passed

Review

• Writer: one writer unit with an adversarial verifier and one repair round. Two findings were fixed: the fork-approval field is renamed to the real approval_policy, and a rollback was added. The coordinator added sha_pinning_required to every documented PUT.

• Independent review: a separate headless claude -p session (Sonnet). Result: needs_changes → 3 findings, all fixed in the repair commit:

  • 1 medium: the secret-alert rule is in public preview, not GA.
  • 2 low: two changelog sources lacked links; sota-sources ruleset drift was not surfaced. It is now recorded as open drift for Top rule: research first, never self-write without a SOTA source; required sota-sources check #294's owner; applying it would block every open PR that predates the job.

  The reviewer independently verified the rest as clean: every live GET, both run conclusions, tests, and that allowed_actions=selected covers every uses: on main.

• Codex cross-family review: skipped. Codex is at its usage limit until 2026-09-30.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.