diff --git a/.changeset/threat-spec-audit-2026-09-15.md b/.changeset/threat-spec-audit-2026-09-15.md new file mode 100644 index 00000000000..e492696f374 --- /dev/null +++ b/.changeset/threat-spec-audit-2026-09-15.md @@ -0,0 +1,5 @@ +--- +"gh-aw": patch +--- + +Daily compiler threat spec audit (2026-09-15): surveyed all open high-severity code-scanning alerts (0 critical). The result set is dominated by Opengrep build-reproducibility findings (`github-actions-npm-install-non-deterministic`, `actions-uv-pip-install-non-deterministic`, `actions-pip-install-inline-no-hash-check`, `github-actions-setup-node-missing-version`, `dockerfile-non-sha-pinned-image`) rather than compiler-generated-workflow threats. All compiler-generated `npm install` calls (`codex_engine.go`, `copilot_engine_installation.go`) already pin exact versions, satisfying the scanner's own documented exception; the remaining flagged items (`test-copilot-github-integration.yml`, `format-and-commit.yml`, the shared `uv pip install` snippet, and the repo `Dockerfile`) are hand-authored/build-tooling files outside `pkg/workflow/`/`pkg/parser/`/`actions/setup/` conformance scope, per specification Section 1's explicit exclusion of "external scanner ecosystems." No compiler/parser source diff exists beyond the single squashed commit state (`d8e1aa7`). No new `CTR-*` rule or implementation change was required; CTR-014 already covers the adjacent in-scope install-script-execution risk. No `threat-detection-suppress` annotations exist in any workflow. Bumped spec to 1.0.36. diff --git a/specs/compiler-threat-detection-changelog.md b/specs/compiler-threat-detection-changelog.md index 059acf5bd95..ceaab990455 100644 --- a/specs/compiler-threat-detection-changelog.md +++ b/specs/compiler-threat-detection-changelog.md @@ -16,6 +16,7 @@ This changelog records the version history and the dated mapping audits for `spe | Version | Change | |---|---| +| 1.0.36 | Audit-only review; Opengrep build-reproducibility alerts (`github-actions-npm-install-non-deterministic`, `actions-uv-pip-install-non-deterministic`, `actions-pip-install-inline-no-hash-check`, `github-actions-setup-node-missing-version`, `dockerfile-non-sha-pinned-image`) are external-scanner findings outside conformance scope; no new CTR rule required. | | 1.0.35 | Audit-only review; open code-scanning alerts (#681/#678/#676/#675 allocation-overflow, #679 useless-assignment, #674/#669/#668/#667 bad-redirect-check, #663 http-to-file-access, #657 smoke-test dummy, #652/#651 stale GraphQL-injection claim, #680 out-of-context stray commit artifacts) are not new compiler threat classes. | | 1.0.34 | Added CTR-027 for trusted same-repository allowlisted bot synchronization and fail-closed confused-deputy handling. | | 1.0.33 | Audit-only review; issue #59894's `close_issue.cjs` command-injection claim is a false positive (no `exec`/subprocess call exists in the file). | @@ -31,6 +32,20 @@ This changelog records the version history and the dated mapping audits for `spe ## Mapping Audits +### Mapping Audit (2026-09-15) + +No compiler/parser source diff exists beyond the single squashed commit state (`d8e1aa7`); no candidate threat surfaced from `pkg/workflow/`, `pkg/parser/`, or `actions/setup/` source changes in the review window. + +Open high-severity code-scanning alerts (0 open critical) were surveyed across the full result set (~260+ alerts) and are dominated by three Opengrep "pr-action" rule families, all concerning build-reproducibility/dependency-pinning rather than the compiler-generated-workflow threat classes in scope: + +- `github-actions-npm-install-non-deterministic` (the large majority of alerts) flags `npm install` (as opposed to `npm ci`) across generated `.lock.yml` files. Tracing the source, every compiler-generated instance (`pkg/workflow/codex_engine.go`'s `BuildStandardNpmEngineInstallStepsNoCooldown`/`generateCodexDockerSbxCLIInstallStep`, and `pkg/workflow/copilot_engine_installation.go`) is a global CLI install with an exact pinned version (e.g. `npm install --ignore-scripts -g @openai/codex@0.153.4`, `npm install --ignore-scripts --no-save @github/copilot-sdk@`), which is the scanner's own documented exception case ("Global installs with pinned versions... are acceptable"). No compiler-side gap exists. One hand-authored, non-compiler-generated workflow (`.github/workflows/test-copilot-github-integration.yml`, no `gh-aw-metadata`/`gh-aw-manifest`/generation header) does install `@github/copilot` unpinned; this is a workflow-hygiene issue in a file outside the compiler's conformance scope (specification Section 1: `pkg/workflow/`, `pkg/parser/`, `actions/setup/`), not a `CTR-*` gap. +- `actions-uv-pip-install-non-deterministic` flags `uv pip install --quiet ... numpy pandas matplotlib seaborn scipy` (no `--frozen`) sourced from the shared markdown snippets `.github/workflows/shared/python-dataviz.md` and `.github/workflows/shared/trending-charts-simple.md`, propagated into several `.lock.yml` files. This concerns third-party visualization dependency reproducibility, not a compiler-injected unsafe behavior; no untrusted input reaches the install command and no privilege-escalation, sandbox-bypass, injection, or unsafe-output-route threat class applies. +- `dockerfile-non-sha-pinned-image` (1 instance, `FROM alpine:3.24` in the repository `Dockerfile`) and `actions-pip-install-inline-no-hash-check` (`.github/workflows/daily-geo-optimizer.lock.yml`, sourced from documentation-only example text in `pkg/workflow/pip_validation.go`) and `github-actions-setup-node-missing-version` (`.github/workflows/format-and-commit.yml`, a hand-authored maintenance workflow, not compiler output) are repository build-tooling and non-compiler-generated-workflow findings, outside `pkg/workflow/`/`pkg/parser/`/`actions/setup/` conformance scope per specification Section 1, which explicitly excludes "external scanner ecosystems." + +None of these findings correspond to the five compiler threat classes in specification Section 3 (privilege escalation, sandbox bypass, injection, unsafe output/supply-chain routes, compile-time drift), and CTR-014 (Supply Chain Attack via Install Scripts) already covers the adjacent, in-scope risk of untrusted pre/postinstall script execution — a distinct concern from install-command determinism. No new `CTR-*` rule is warranted; no implementation change is required. + +No live `threat-detection-suppress` annotation exists in any workflow frontmatter (only illustrative documentation examples), so no `SLA_BREACH` applies. No suppression is older than 10 or 20 business days because none exist. + ### Mapping Audit (2026-09-13) No compiler/parser source diff exists beyond the single squashed commit state (`0489fac`, "Share API rate-limit state across multi-target logs downloads", #60531); no candidate threat surfaced from `pkg/workflow/`, `pkg/parser/`, or `actions/setup/` source changes in the review window. diff --git a/specs/compiler-threat-detection-spec.md b/specs/compiler-threat-detection-spec.md index fe2f768b26b..ac6634750f6 100644 --- a/specs/compiler-threat-detection-spec.md +++ b/specs/compiler-threat-detection-spec.md @@ -7,7 +7,7 @@ sidebar: # GitHub Actions Compiler Threat Detection Specification -**Version**: 1.0.35 +**Version**: 1.0.36 **Status**: Candidate Recommendation **Latest Version**: https://github.com/github/gh-aw/blob/main/specs/compiler-threat-detection-spec.md **Editors**: GitHub Next (GitHub, Inc.) @@ -32,6 +32,7 @@ Each version maps to the minimum compatible binary. A version change MUST update | Versions | Minimum gh-aw | Compatibility | |---|---:|---| +| `1.0.36` | `v0.87.9` | Audit-only; Opengrep build-reproducibility findings (non-deterministic `npm`/`uv pip` installs, non-SHA-pinned Dockerfile image) are out of conformance scope per Section 1. | | `1.0.35` | `v0.87.9` | Audit-only; #681/#678/#676/#675, #679, #674/#669/#668/#667, #663, #657, #652/#651, and #680 are not new threat classes. | | `1.0.34` | `v0.87.9` | Adds CTR-027; allowlisted bot synchronization requires trusted same-repository provenance. | | `1.0.33` | `v0.87.9` | Audit-only; no new CTR rule or lock-file schema change. |