From 497a367f8d95a05743d0f94c43063cbf918627f2 Mon Sep 17 00:00:00 2001 From: Quark Assistant Date: Tue, 12 May 2026 17:33:46 -0500 Subject: [PATCH 1/2] ci: add default-deny workflow permissions (contents: read) Defends against the GitHub Actions Cache poisoning + OIDC-token-extraction attack chain documented in the May 2026 TanStack supply-chain compromise: without an explicit top-level permissions block, a malicious dependency running during build could acquire write scopes via the runner's GITHUB_TOKEN and modify repository state. Setting permissions: contents: read at the workflow level forces any job that needs more (e.g. a future release publish) to opt up explicitly, making elevated scopes auditable in the workflow file. No behavior change for the existing three jobs (lint/build/test), which only consume the repository contents. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f4ad54d..8fea887 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,6 +8,12 @@ on: branches: - main +# Default-deny: jobs that need write scopes must opt up explicitly. +# Prevents the GitHub Actions Cache poisoning + OIDC-token-write attack chain +# documented in the May 2026 TanStack supply-chain compromise. +permissions: + contents: read + jobs: lint: runs-on: ubuntu-22.04 From 517208146676f8a94089b874095ead6f598f6800 Mon Sep 17 00:00:00 2001 From: Quark Assistant Date: Tue, 12 May 2026 17:37:11 -0500 Subject: [PATCH 2/2] =?UTF-8?q?ci:=20fix=20trigger=20branches=20main=20?= =?UTF-8?q?=E2=86=92=20production?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The repository's default branch is `production` (not `main`). The CI workflow was configured to fire on push/pull_request to `main`, which does not exist, so CI has not run on any PR for the lifetime of this file. Visible symptom: PRs against `production` show 0 status checks. Fix: align the trigger branch list with the repository's actual default branch so lint/build/test run on every PR and push as intended. Combined with the default-deny permissions block from the previous commit, CI is now both functional and hardened. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8fea887..310f8c6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,10 +3,10 @@ name: UI CI on: pull_request: branches: - - main + - production push: branches: - - main + - production # Default-deny: jobs that need write scopes must opt up explicitly. # Prevents the GitHub Actions Cache poisoning + OIDC-token-write attack chain