Skip to content

feat(ci): adopt go-install-hardened workflow (Shai-Hulud defense) #153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
srt0422 wants to merge 2 commits into
base: dev
Choose a base branch
from
Open

feat(ci): adopt go-install-hardened workflow (Shai-Hulud defense) #153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
132659b
feat(ci): adopt go-install-hardened workflow (Shai-Hulud defense)
claude May 14, 2026
da1d6ca
fix(ci): re-pin go-install-hardened to ci-workflows-private v1 head
srt0422 Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/workflows/go-hardened.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
name: Go hardened install
on:
pull_request:
paths:
- 'go.mod'
- 'go.sum'
- '**/*.go'
- '.github/workflows/go-hardened.yml'
push:
branches: [main, master, dev, staging]
permissions:
contents: read
jobs:
hardened-install:
uses: allora-network/ci-workflows-private/.github/workflows/go-install-hardened.yml@11e340a585e2b764a64fa70e9afc06da334d57f0

@srt0422 srt0422 Jul 17, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

needs-human: SHA-pinned reusable-workflow ref fails GitHub evaluation org-wide; @v1 succeeds

The re-pin pushed in da1d6ca (fa8a0e1 → 11e340a5, current v1 head of ci-workflows-private) is correct on the merits: the callee's own action pins resolve, and forge-v2 ran this exact callee commit green today. This PR's hardened-install check still fails at workflow evaluation time (zero jobs created; "workflow file issue") before any step runs.

Evidence the blocker is org-level, not PR-level:

  • Identical zero-job evaluation failure on every SHA-pinned caller checked: allora-chain @0d80a856 (runs 07-07…07-13), allora-offchain-operator @0d80a856 (5 runs today), forge-data-service @0d80a856 (05-15, 06-03, 07-01), allora-indexer @f16605a4 (05-14), this repo @11e340a5 (today).
  • forge-v2 calls the same callee commit via the @v1 branch ref; its Hardened Go install job succeeded today on a pull_request run (run 29610970018). The calling job there is structurally identical to this one apart from the ref type.
  • The callee file exists and is structurally valid at every pinned SHA; all callers pass only declared inputs.
  • The only prior evaluation success on record for this repo is the original fa8a0e1 pin on 2026-05-14.

This pattern is consistent with an org-level Actions allow-list ("Allowed actions and reusable workflows") that admits the callee at @v1 (and the legacy fa8a0e1 SHA) but not at other SHAs. The org policy endpoints return 403 for this token, so that cannot be confirmed directly.

Two resolution paths, both org-admin decisions:

  1. Admit the pinned SHA 11e340a585e2b764a64fa70e9afc06da334d57f0 (or a wildcard covering ci-workflows-private SHAs) in the org's allowed-actions policy — preserves the SHA-pinning posture this PR exists to enforce.
  2. Switch the caller to @v1 (as forge-v2 does). This contradicts the documented SHA-pin policy (see forge-data-service's go-hardened.yml header) and weakens the Shai-Hulud posture, since v1 is currently a branch, not a tag.

The SHA pin is left in place pending that decision. hardened-install is not a required check (no branch protection on dev), so this does not block merging mechanically.

with:
go_version: stable
cgo_enabled: '0'
5 changes: 5 additions & 0 deletions go.env
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# Shai-Hulud defense - Go module integrity pinning.
# See allora-network/skills (skills/shai-hulud-defense) for rationale.
GOPROXY=https://proxy.golang.org,direct
GOSUMDB=sum.golang.org
GOFLAGS=-mod=readonly
Loading