Skip to content

Fix: Harden CI/CD supply chain controls and explicit secret boundaries #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
magqqgq wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fix: Harden CI/CD supply chain controls and explicit secret boundaries #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
086eeb0
Fix: Harden CI/CD supply chain controls and explicit secret boundaries
magqqgq Aug 25, 2026
69a73d3
Add files via upload
magqqgq Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions .github/workflows/securesdlc-required-workflow-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,16 @@ run-name: "[Nautilus SecureSDLC Required DEV] Ref:${{ github.ref_name }} Event:$

on:
workflow_dispatch: {}
workflow_call: {}
workflow_call:
secrets:
SEMGREP_APP_URL:
required: false
SEMGREP_APP_TOKEN:
required: false
SDLC_SLACK_NOTIFICATIONS:
required: false
pull_request: {}
# pull_request_target: {} # Gives workflows excessive permissions. Not wanted.
# pull_request_target is intentionally not used because it would grant workflows excessive permissions.
merge_group: {}

jobs:
Expand All @@ -14,8 +21,8 @@ jobs:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@main
uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@d0c22c2ca17f94fd70054496c71a63f5eeba75e7
secrets:
SEMGREP_APP_URL: ${{ secrets.SEMGREP_APP_URL }}
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
SDLC_SLACK_NOTIFICATIONS: ${{ secrets.SDLC_SLACK_NOTIFICATIONS }}
SDLC_SLACK_NOTIFICATIONS: ${{ secrets.SDLC_SLACK_NOTIFICATIONS }}
20 changes: 13 additions & 7 deletions .github/workflows/securesdlc-required-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,21 +3,27 @@ run-name: "[Nautilus SecureSDLC Required] Ref:${{ github.ref_name }} Event:${{ g

on:
workflow_dispatch: {}
workflow_call: {}
workflow_call:
secrets:
SEMGREP_APP_URL:
required: false
SEMGREP_APP_TOKEN:
required: false
SDLC_SLACK_NOTIFICATIONS:
required: false
pull_request: {}
# pull_request_target: {} # Gives workflows excessive permissions. Not wanted.
# Needed by repos with a merge queue: the gate re-runs on the gh-readonly-queue
# ref, so a workflow that never fires there can never report and entries deadlock.
# pull_request_target is intentionally not used because it would grant workflows excessive permissions.
# The merge queue needs this event so its required status check can be reported.
merge_group: {}

jobs:
securesdlc-umbrella:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@release-stable
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@d61b052e36d795bf5ed9eeb116b4851cc0bbdcdd
secrets:
SEMGREP_APP_URL: ${{ secrets.SEMGREP_APP_URL }}
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
SDLC_SLACK_NOTIFICATIONS: ${{ secrets.SDLC_SLACK_NOTIFICATIONS }}
SDLC_SLACK_NOTIFICATIONS: ${{ secrets.SDLC_SLACK_NOTIFICATIONS }}
13 changes: 10 additions & 3 deletions .github/workflows/securesdlc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,14 @@ run-name: "[Nautilus SecureSDLC] Ref:${{ github.ref_name }} Event:${{ github.eve

on:
workflow_dispatch: {}
workflow_call: {}
workflow_call:
secrets:
SEMGREP_APP_URL:
required: false
SEMGREP_APP_TOKEN:
required: false
SDLC_SLACK_NOTIFICATIONS:
required: false
push:
branches: [ main ]

Expand All @@ -12,8 +19,8 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@release-stable
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@d61b052e36d795bf5ed9eeb116b4851cc0bbdcdd
secrets:
SEMGREP_APP_URL: ${{ secrets.SEMGREP_APP_URL }}
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
Expand Down
13 changes: 10 additions & 3 deletions workflow-templates/securesdlc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,14 @@ run-name: "[Nautilus SecureSDLC Reusable] Ref:${{ github.ref_name }} Event:${{ g

on:
workflow_dispatch: {}
workflow_call: {}
workflow_call:
secrets:
SEMGREP_APP_URL:
required: false
SEMGREP_APP_TOKEN:
required: false
SDLC_SLACK_NOTIFICATIONS:
required: false
push:
branches: [ $default-branch ]

Expand All @@ -12,8 +19,8 @@ jobs:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@release-stable
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@d61b052e36d795bf5ed9eeb116b4851cc0bbdcdd
secrets:
SEMGREP_APP_URL: ${{ secrets.SEMGREP_APP_URL }}
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
Expand Down