mirror of
https://github.com/Cacti/cacti.git
synced 2026-10-23 03:27:02 +09:00
e24e78d77e
* ci: add AI security review workflow for PRs Adds a GitHub Actions workflow that runs on every PR targeting develop. The job collects the PR diff, grep hits on changed PHP files (SQL sinks, superglobal access, command execution, dynamic includes, file writes, archive extraction), and 120-line excerpts from historically vulnerable hotspot files. It feeds all of this to claude-opus-4-6 using a structured security review prompt and posts the model's findings as a PR comment. The job fails (blocking merge) when the model returns "BLOCK PR". API or infrastructure errors are non-fatal so they do not block unrelated PRs. Requires the ANTHROPIC_API_KEY repository secret. Fork PRs skip gracefully when the secret is absent. Closes #6936-related CI gap — continuous variant-class hunting on every PR without manual triage overhead. Signed-off-by: Thomas Vincent <thomasvincent@somethingwithproof.com> Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: remove AI branding from security review workflow Signed-off-by: Thomas Vincent <thomasvincent@somethingwithproof.com> Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: add security posture and perf regression workflows Add PHP-oriented parity guardrails similar to Spine modernization: - new security posture workflow (TruffleHog, Semgrep SARIF, Scorecard, Composer audit, workflow policy checks) - new performance regression workflow with hyperfine + RSS thresholds - workflow policy checker script for pinned-action/strict-shell validation - versioned CLI performance baseline file Fixes #6822 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: address copilot feedback on security and perf workflows Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: fix scorecard install, sarif upload pin, and perf baseline bootstrap Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: avoid github context interpolation in security review run steps Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: gate secret-dependent steps and fix composer audit, sarif, artifact pins Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: generate composer lock without --lock for audit The --lock flag needs an existing composer.lock; Cacti ships none, so the audit step exited 3. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: report composer audit advisories as non-blocking Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: use a valid model id for the security review and cover security-review.yml in policy lint Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: address review feedback on security and perf workflows - grant issues:write so the security review can post PR comments - harden i18n run step by passing github context via env vars - fail the security gate when the API returns no usable text - fetch origin/<base> before reading the trusted perf baseline Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: harden review gate, workflow policy, and perf job - security_review.py: gate on the model's parsed final-decision marker instead of a "BLOCK PR" substring match, which misfired on prose ("I would not BLOCK PR") and on the attacker-controlled diff echoing the instruction text back into the review body - check-workflow-policy.py: also validate job-level reusable-workflow `uses:` and require docker:// references to be pinned by an @sha256 digest - perf-regression.yml: skip the benchmark job on fork PRs so an untrusted fork cannot run baseline-defined commands during the bootstrap window Co-Authored-By: Oz <oz-agent@warp.dev> * ci: scope security review write permissions to the job Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@somethingwithproof.com> Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Thomas Vincent <thomas@vincent.dev> Co-authored-by: Oz <oz-agent@warp.dev> Co-authored-by: TheWitness <thewitness@cacti.net>