ci: supply-chain hardening (PR 1/2) — Node 24, harden-runner, Dependabot cooldown, CodeQL - #42
Merged
Nelson Spence (Fieldnote-Echo) merged 6 commits intoMay 25, 2026
Conversation
Node-20 deprecation fix (GitHub forces Node 24 by 2026-06): actions/checkout v4->v6 (ci/python as tags; audit/changelog re-pinned to the v6.0.2 SHA), actions/setup-python v5->v6 (python). Adds step-security/harden-runner@v2.19.4 (SHA-pinned, egress-policy: audit) as the first step of every job — an EDR-style egress/process/file baseline. Audit (not block) avoids breaking egress and is supported on Linux/macOS/Windows runners. The changelog SemVer gate is unchanged.
github-actions (primary), cargo (workspace + the excluded fuzz crate), and pip (ordvec-python). Every ecosystem carries cooldown.default-days: 7 so nothing is auto-bumped same-day — a freshly published malicious release (the 'mini shai-hulud' npm-worm class of supply-chain attack) gets a week to be flagged/yanked before we'd open a PR. Grouped to cut noise.
Scans rust + python + actions (all GA; build-mode: none — no compiler/MSRV run). push/PR to main + weekly schedule (off the audit.yml slot). Least-privilege: security-events: write only on the analyze job; all actions SHA-pinned (scheduled + write-scoped); harden-runner first.
Nelson Spence (Fieldnote-Echo)
requested a review
from Navi Bot (project-navi-bot)
as a code owner
May 25, 2026 15:02
Review Summary by QodoSupply-chain hardening: Node 24, harden-runner, Dependabot, CodeQL
WalkthroughsDescription• Upgrade Node.js runtime to v24 (checkout v4→v6, setup-python v5→v6) • Add harden-runner EDR baseline to all 13 jobs across workflows • Implement Dependabot with 7-day cooldown for supply-chain attack mitigation • Add CodeQL scanning for Rust, Python, and GitHub Actions code Diagramflowchart LR
A["GitHub Actions<br/>Node 20 Deprecation"] -->|"Upgrade to v24"| B["Update checkout v4→v6<br/>setup-python v5→v6"]
C["Supply-Chain<br/>Attack Risk"] -->|"EDR Baseline"| D["harden-runner v2.19.4<br/>audit egress policy"]
E["Malicious Release<br/>Detection"] -->|"7-day Cooldown"| F["Dependabot<br/>github-actions/cargo/pip"]
G["Code Security<br/>Scanning"] -->|"Multi-language"| H["CodeQL<br/>Rust/Python/Actions"]
B --> I["All Workflows<br/>Hardened"]
D --> I
F --> I
H --> I
File Changes1. .github/dependabot.yml
|
Code Review by Qodo
1.
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Copilot started reviewing on behalf of
Nelson Spence (Fieldnote-Echo)
May 25, 2026 15:03
View session
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new .github/dependabot.yml configuration file to automate dependency updates for GitHub Actions, Cargo, and Pip. The review feedback correctly identifies that the cooldown property included in all update blocks is not supported by the official Dependabot schema and will cause the configuration to be invalid.
There was a problem hiding this comment.
Pull request overview
This PR introduces supply-chain hardening for the repository’s GitHub Actions CI by upgrading Node-24-compatible action versions, adding runner egress auditing, configuring Dependabot across ecosystems with a cooldown, and enabling CodeQL scanning.
Changes:
- Upgraded CI workflows to
actions/checkout@v6(tagged for read-only CI; SHA-pinned where scheduled/write-scoped) andactions/setup-python@v6in the Python CI workflow. - Added
step-security/harden-runner(SHA-pinned) as the first step of each job withegress-policy: audit. - Added new
.github/dependabot.yml(multi-ecosystem, grouped updates, 7-day cooldown) and a new SHA-pinned CodeQL workflow scanning Rust, Python, and GitHub Actions.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/ci.yml | Adds harden-runner and updates checkout to v6 across all CI jobs. |
| .github/workflows/python.yml | Adds harden-runner; updates checkout to v6 and setup-python to v6 for the bindings CI. |
| .github/workflows/audit.yml | Adds harden-runner and updates SHA-pinned checkout to v6.0.2 for scheduled advisories scans. |
| .github/workflows/changelog.yml | Adds harden-runner and updates SHA-pinned checkout to v6.0.2 in the write-scoped release-notes workflow. |
| .github/workflows/codeql.yml | Adds a new SHA-pinned CodeQL workflow with least-privilege permissions and no-build analysis. |
| .github/dependabot.yml | Adds Dependabot configuration for github-actions, cargo (root + fuzz), and pip (ordvec-python) with grouping and cooldown. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6654601316
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
Codex P1 (#42): github/codeql-action@v3 still declares runs.using: node20 for init/analyze, so it would break at the Node-20 retirement. v4 runs on node24 (verified: init/action.yml -> 'using: node24'). Pin init + analyze to the v4 SHA 7211b7c. Same inputs (languages / build-mode: none / category); the analyze legs already pass on v3, and v4 is the same engine on a newer runtime.
project-navi-bot
previously approved these changes
May 25, 2026
…review) qodo (Reliability): on a pull_request from a fork, GitHub provides a read-only GITHUB_TOKEN, so github/codeql-action/analyze's SARIF upload (security-events: write) fails — a spurious failure on external PRs. Gate the analyze job with 'github.event_name != pull_request || head.repo.full_name == github.repository' so it runs on push-to-main + the weekly schedule (full coverage) and same-repo PRs (PR-time scanning), and skips fork PRs. CodeQL is also not in the required-status-check set, so fork PRs are never blocked regardless.
project-navi-bot
approved these changes
May 25, 2026
Member
Author
|
/agentic_review |
|
Persistent review updated to latest commit 4a73aa3 |
Nelson Spence (Fieldnote-Echo)
deleted the
chore/supply-chain-ci-hardening
branch
May 25, 2026 15:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pre-release supply-chain hardening, part 1 of 2 (always-on CI; PR-2 will add SBOM + build-provenance attestation to the held release workflows). Built in parallel by Opus supply-chain subagents on disjoint files, then centrally verified.
Changes
actions/checkoutv4→v6,actions/setup-pythonv5→v6. ci.yml/python.yml use major tags (read-only CI); audit.yml/changelog.yml re-pinned to the v6.0.2 SHA (scheduled / write-scoped).step-security/harden-runner@v2.19.4, SHA-pinned,egress-policy: audit) as the first step of every job across ci/python/audit/changelog/codeql — an EDR-style egress/process/file baseline. Audit (not block) avoids breaking egress and is supported on Linux/macOS/Windows..github/dependabot.yml) —github-actions(primary) +cargo(workspace + the excludedfuzzcrate) +pip(ordvec-python). Every ecosystem hascooldown.default-days: 7→ no same-day bumps, so a freshly published malicious release (the "mini shai-hulud" worm class) has a week to be flagged before we PR it. Grouped to cut noise..github/workflows/codeql.yml) — scans rust + python + actions (all GA;build-mode: none, no compiler run). push/PR to main + weekly (off the audit.yml slot). Least-privilege (security-events: writeonly on the analyze job); all actions SHA-pinned.Pinning policy (consistent)
SHA-pin every action in write-scoped or scheduled workflows (audit, changelog, codeql); major tags in read-only push/PR CI (ci, python).
harden-runnerSHA-pinned everywhere. Dependabot now keeps all of these current — delayed 7 days.Verified locally
checkout@v4/setup-python@v5refs.testlegs; CodeQLbuild-mode: noneconfirmed valid for rust/python/actions.Excluded by design:
changelog.ymlNode bump is included here (since #41 merged). The release workflows (release-crate.yml/release-python.yml) were already on checkout v6; their SBOM + attestation hardening is PR-2.Merges under the strict protection (CI + 1 non-self code-owner approval).