* security(ci): constrain dependency installs and container build boundaries
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(docker): retain shipped runtime libraries in build context
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(tooling): quote gettext paths and honor Docker base selection
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(auth): use certificate expiry truth in rendering assertions
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(tooling): finish Docker layer and regex scan findings
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(ci): preserve documentation badge anchors without alternation
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(ci): preserve contributor badges and enforce Python coverage
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: share changed-code coverage contracts and enforce shell policy
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(ci): enforce private review files and run path regressions
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: measure changed gettext shell coverage
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: pin coverage to the reviewed PR revision
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: add AI security review workflow for PRs
Adds a GitHub Actions workflow that runs on every PR targeting develop.
The job collects the PR diff, grep hits on changed PHP files (SQL sinks,
superglobal access, command execution, dynamic includes, file writes,
archive extraction), and 120-line excerpts from historically vulnerable
hotspot files. It feeds all of this to claude-opus-4-6 using a
structured security review prompt and posts the model's findings as a
PR comment.
The job fails (blocking merge) when the model returns "BLOCK PR". API
or infrastructure errors are non-fatal so they do not block unrelated
PRs.
Requires the ANTHROPIC_API_KEY repository secret. Fork PRs skip
gracefully when the secret is absent.
Closes #6936-related CI gap — continuous variant-class hunting on every
PR without manual triage overhead.
Signed-off-by: Thomas Vincent <thomasvincent@somethingwithproof.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: remove AI branding from security review workflow
Signed-off-by: Thomas Vincent <thomasvincent@somethingwithproof.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: add security posture and perf regression workflows
Add PHP-oriented parity guardrails similar to Spine modernization:
- new security posture workflow (TruffleHog, Semgrep SARIF, Scorecard,
Composer audit, workflow policy checks)
- new performance regression workflow with hyperfine + RSS thresholds
- workflow policy checker script for pinned-action/strict-shell validation
- versioned CLI performance baseline file
Fixes#6822
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: address copilot feedback on security and perf workflows
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: fix scorecard install, sarif upload pin, and perf baseline bootstrap
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: avoid github context interpolation in security review run steps
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: gate secret-dependent steps and fix composer audit, sarif, artifact pins
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: generate composer lock without --lock for audit
The --lock flag needs an existing composer.lock; Cacti ships none, so the audit step exited 3.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: report composer audit advisories as non-blocking
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: use a valid model id for the security review and cover security-review.yml in policy lint
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: address review feedback on security and perf workflows
- grant issues:write so the security review can post PR comments
- harden i18n run step by passing github context via env vars
- fail the security gate when the API returns no usable text
- fetch origin/<base> before reading the trusted perf baseline
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: harden review gate, workflow policy, and perf job
- security_review.py: gate on the model's parsed final-decision marker
instead of a "BLOCK PR" substring match, which misfired on prose
("I would not BLOCK PR") and on the attacker-controlled diff echoing the
instruction text back into the review body
- check-workflow-policy.py: also validate job-level reusable-workflow `uses:`
and require docker:// references to be pinned by an @sha256 digest
- perf-regression.yml: skip the benchmark job on fork PRs so an untrusted
fork cannot run baseline-defined commands during the bootstrap window
Co-Authored-By: Oz <oz-agent@warp.dev>
* ci: scope security review write permissions to the job
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@somethingwithproof.com>
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Thomas Vincent <thomas@vincent.dev>
Co-authored-by: Oz <oz-agent@warp.dev>
Co-authored-by: TheWitness <thewitness@cacti.net>
Thomas Vincent