ci: workflow hardening (permissions + trigger fix) - #1
Merged
Conversation
Defends against the GitHub Actions Cache poisoning + OIDC-token-extraction attack chain documented in the May 2026 TanStack supply-chain compromise: without an explicit top-level permissions block, a malicious dependency running during build could acquire write scopes via the runner's GITHUB_TOKEN and modify repository state. Setting permissions: contents: read at the workflow level forces any job that needs more (e.g. a future release publish) to opt up explicitly, making elevated scopes auditable in the workflow file. No behavior change for the existing three jobs (lint/build/test), which only consume the repository contents. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The repository's default branch is `production` (not `main`). The CI workflow was configured to fire on push/pull_request to `main`, which does not exist, so CI has not run on any PR for the lifetime of this file. Visible symptom: PRs against `production` show 0 status checks. Fix: align the trigger branch list with the repository's actual default branch so lint/build/test run on every PR and push as intended. Combined with the default-deny permissions block from the previous commit, CI is now both functional and hardened. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
QuarkAssistant
marked this pull request as ready for review
May 12, 2026 22:37
QuarkAssistant
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two security/CI fixes to
.github/workflows/ci.yml:1. Default-deny workflow permissions
Defends against the GitHub Actions Cache poisoning + OIDC-token-write attack chain documented in the May 2026 TanStack supply-chain compromise.
Forces any future job that needs more (e.g. release publish) to opt up explicitly.
2. Trigger-branch fix:
main→productionThe workflow listened for
pull_request/pushonmain, but the repository's default branch (both fork and upstreamKleo-Network/kleo-connect) isproduction. There is nomainbranch. The workflow never fired, which is why PRs (including Kleo-Network#86 upstream) have been showing 0 status checks for hours.Test plan
Companion PR to upstream
Kleo-Network/kleo-connectwill be opened with the same changes.🤖 Generated with Claude Code