From 132659b314857cec4ad330e190a68253efaeea16 Mon Sep 17 00:00:00 2001 From: "Scott Terry (agent)" Date: Thu, 14 May 2026 14:51:55 -0700 Subject: [PATCH 1/2] feat(ci): adopt go-install-hardened workflow (Shai-Hulud defense) Pins GOPROXY/GOSUMDB/GOFLAGS in go.env and routes Go install/verify/ vuln-scan through the shared ci-workflows-private workflow. Companion to allora-network/ci-workflows-private#17 and the shai-hulud-defense skill (allora-network/skills#69). Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/go-hardened.yml | 18 ++++++++++++++++++ go.env | 5 +++++ 2 files changed, 23 insertions(+) create mode 100644 .github/workflows/go-hardened.yml create mode 100644 go.env diff --git a/.github/workflows/go-hardened.yml b/.github/workflows/go-hardened.yml new file mode 100644 index 0000000..846e719 --- /dev/null +++ b/.github/workflows/go-hardened.yml @@ -0,0 +1,18 @@ +name: Go hardened install +on: + pull_request: + paths: + - 'go.mod' + - 'go.sum' + - '**/*.go' + - '.github/workflows/go-hardened.yml' + push: + branches: [main, master, dev, staging] +permissions: + contents: read +jobs: + hardened-install: + uses: allora-network/ci-workflows-private/.github/workflows/go-install-hardened.yml@fa8a0e1361216ec0c75e4d822f648248083e229b + with: + go_version: stable + cgo_enabled: '0' diff --git a/go.env b/go.env new file mode 100644 index 0000000..6c07c29 --- /dev/null +++ b/go.env @@ -0,0 +1,5 @@ +# Shai-Hulud defense - Go module integrity pinning. +# See allora-network/skills (skills/shai-hulud-defense) for rationale. +GOPROXY=https://proxy.golang.org,direct +GOSUMDB=sum.golang.org +GOFLAGS=-mod=readonly From da1d6ca04e0619dd608f2bac3ea0f47c1c855acc Mon Sep 17 00:00:00 2001 From: srt0422 <869171+srt0422@users.noreply.github.com> Date: Fri, 17 Jul 2026 13:10:12 -0700 Subject: [PATCH 2/2] fix(ci): re-pin go-install-hardened to ci-workflows-private v1 head review-fix-loop iteration 1 reviewer(s): persona file: .github/workflows/go-hardened.yml:15 --- .github/workflows/go-hardened.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/go-hardened.yml b/.github/workflows/go-hardened.yml index 846e719..5fd4592 100644 --- a/.github/workflows/go-hardened.yml +++ b/.github/workflows/go-hardened.yml @@ -12,7 +12,7 @@ permissions: contents: read jobs: hardened-install: - uses: allora-network/ci-workflows-private/.github/workflows/go-install-hardened.yml@fa8a0e1361216ec0c75e4d822f648248083e229b + uses: allora-network/ci-workflows-private/.github/workflows/go-install-hardened.yml@11e340a585e2b764a64fa70e9afc06da334d57f0 with: go_version: stable cgo_enabled: '0'