From d5f9d3a382bc2552b1f4210cdd57c41897bde471 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 11 Oct 2026 22:02:47 +0000 Subject: [PATCH 1/3] ci: gate the release on an Aikido scan The aikido-gate job runs scan-release. The build job waits for that scan. OIDC stays on the build job only. The checklist records pull request 170 as done. Co-authored-by: Jared Wray --- .github/workflows/release.yaml | 55 ++++++++++++++++++++++++++++------ DEFENSE_IN_DEPTH.md | 4 +-- 2 files changed, 48 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6b0f56f..d66db9d 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -7,20 +7,57 @@ on: permissions: contents: read - # Required for npm trusted publishing (OIDC) and provenance attestations - id-token: write - -env: - HYPHEN_PUBLIC_API_KEY: ${{ secrets.HYPHEN_PUBLIC_API_KEY }} - HYPHEN_API_KEY: ${{ secrets.HYPHEN_API_KEY }} - HYPHEN_APPLICATION_ID: ${{ secrets.HYPHEN_APPLICATION_ID }} - HYPHEN_ORGANIZATION_ID: ${{ secrets.HYPHEN_ORGANIZATION_ID }} - HYPHEN_LINK_DOMAIN: ${{ secrets.HYPHEN_LINK_DOMAIN }} jobs: + aikido-gate: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Install Socket Firewall + uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2 + with: + mode: firewall-free + firewall-version: "1.15.4" + + - name: Set up Node.js + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 + with: + node-version: 22 + package-manager-cache: false + + - name: Install Aikido CI client + # zizmor: ignore[adhoc-packages] pinned Aikido CI client for the release gate + run: sfw npm install --global @aikidosec/ci-api-client@1.0.17 + + - name: Run Aikido release scan + # The scan fails when Aikido reports a new finding. + # The API key comes from the Aikido CI settings. + # The key cannot publish a package. + env: + REPO_NAME: ${{ github.event.repository.name }} + AIKIDO_CLIENT_API_KEY: ${{ secrets.AIKIDO_CLIENT_API_KEY }} + run: > + aikido-api-client scan-release + "$REPO_NAME" "$GITHUB_SHA" + --apikey "$AIKIDO_CLIENT_API_KEY" + --fail-on-sast-scan --fail-on-iac-scan --fail-on-secrets-scan + build: + needs: [aikido-gate] runs-on: ubuntu-latest + permissions: + contents: read + # OIDC lets this job stage the package. + id-token: write + + env: + HYPHEN_PUBLIC_API_KEY: ${{ secrets.HYPHEN_PUBLIC_API_KEY }} + HYPHEN_API_KEY: ${{ secrets.HYPHEN_API_KEY }} + HYPHEN_APPLICATION_ID: ${{ secrets.HYPHEN_APPLICATION_ID }} + HYPHEN_ORGANIZATION_ID: ${{ secrets.HYPHEN_ORGANIZATION_ID }} + HYPHEN_LINK_DOMAIN: ${{ secrets.HYPHEN_LINK_DOMAIN }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index 4ef9de9..e376341 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -38,7 +38,7 @@ Profile: npm library · public ## 5. npm publishing — npm libraries only - [ ] OIDC trusted publishing configured **stage-only** on npmjs.com for the publish workflow — it can stage, never publish live (manual) -- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` (PR #170 pending) +- [x] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` — PR #170 - [ ] Maintainer promotes staged versions with 2FA (manual) - [ ] Drydock connected — staged releases reviewed before promotion (manual) - [ ] No direct publish rights: package requires 2FA and disallows tokens (manual) @@ -46,7 +46,7 @@ Profile: npm library · public ## 6. Security tooling - [x] Aikido runs on every build — verified 2026-10-08 -- [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release` +- [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release` (PR pending) - [ ] Socket reviews every PR that changes dependencies ## 7. Repository lockdown From 78655fc7a5b12df6dda9690335570a8108fe089a Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 11 Oct 2026 22:03:08 +0000 Subject: [PATCH 2/3] docs: record pull request 171 on the Aikido gate item The checklist names the open pull request. Co-authored-by: Jared Wray --- DEFENSE_IN_DEPTH.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md index e376341..5e1d03a 100644 --- a/DEFENSE_IN_DEPTH.md +++ b/DEFENSE_IN_DEPTH.md @@ -46,7 +46,7 @@ Profile: npm library · public ## 6. Security tooling - [x] Aikido runs on every build — verified 2026-10-08 -- [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release` (PR pending) +- [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release` (PR #171 pending) - [ ] Socket reviews every PR that changes dependencies ## 7. Repository lockdown From 51cb2e66df15c489707cca74e5d51a66cf31d55d Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sun, 11 Oct 2026 22:09:06 +0000 Subject: [PATCH 3/3] ci: bound the Aikido release scan The aikido-gate job stops after 15 minutes. The scan fails at severity LOW or above. Co-authored-by: Jared Wray --- .github/workflows/release.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index d66db9d..98d1f1e 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -11,6 +11,8 @@ permissions: jobs: aikido-gate: runs-on: ubuntu-latest + # A stalled scan stops after 15 minutes. + timeout-minutes: 15 permissions: contents: read steps: @@ -31,7 +33,7 @@ jobs: run: sfw npm install --global @aikidosec/ci-api-client@1.0.17 - name: Run Aikido release scan - # The scan fails when Aikido reports a new finding. + # The scan fails when Aikido reports a new finding at severity LOW or above. # The API key comes from the Aikido CI settings. # The key cannot publish a package. env: @@ -42,6 +44,7 @@ jobs: "$REPO_NAME" "$GITHUB_SHA" --apikey "$AIKIDO_CLIENT_API_KEY" --fail-on-sast-scan --fail-on-iac-scan --fail-on-secrets-scan + --minimum-severity-level LOW build: needs: [aikido-gate]