Skip to content

root - chore: defense - gate releases with Aikido #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jaredwray merged 3 commits into from
Oct 11, 2026
Merged

root - chore: defense - gate releases with Aikido #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d5f9d3a
ci: gate the release on an Aikido scan
cursoragent Oct 11, 2026
78655fc
docs: record pull request 171 on the Aikido gate item
cursoragent Oct 11, 2026
51cb2e6
ci: bound the Aikido release scan
cursoragent Oct 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 49 additions & 9 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,20 +7,60 @@ on:

permissions:
contents: read
# Required for npm trusted publishing (OIDC) and provenance attestations
id-token: write

env:
HYPHEN_PUBLIC_API_KEY: ${{ secrets.HYPHEN_PUBLIC_API_KEY }}
HYPHEN_API_KEY: ${{ secrets.HYPHEN_API_KEY }}
HYPHEN_APPLICATION_ID: ${{ secrets.HYPHEN_APPLICATION_ID }}
HYPHEN_ORGANIZATION_ID: ${{ secrets.HYPHEN_ORGANIZATION_ID }}
HYPHEN_LINK_DOMAIN: ${{ secrets.HYPHEN_LINK_DOMAIN }}

jobs:
aikido-gate:
runs-on: ubuntu-latest
# A stalled scan stops after 15 minutes.
timeout-minutes: 15
permissions:
contents: read
steps:
- name: Install Socket Firewall
uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
with:
mode: firewall-free
firewall-version: "1.15.4"

- name: Set up Node.js
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: 22
package-manager-cache: false

- name: Install Aikido CI client
# zizmor: ignore[adhoc-packages] pinned Aikido CI client for the release gate
run: sfw npm install --global @aikidosec/ci-api-client@1.0.17

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use pnpm to install the Aikido client

This release job uses npm to install the client. The repository requires pnpm for all package management commands. Add pnpm and use it here.

AGENTS.md reference: AGENTS.md:L3-L3

Useful? React with 👍 / 👎.

@cursor cursor Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Line 33 keeps sfw npm install --global @aikidosec/ci-api-client@1.0.17.
The skill template uses that command.
The Aikido install guide uses the same npm command.
setup-node puts that global binary on PATH.
pnpm bin -g returns an empty path here, so a global pnpm install can omit the client from PATH.


- name: Run Aikido release scan
# The scan fails when Aikido reports a new finding at severity LOW or above.
# The API key comes from the Aikido CI settings.
# The key cannot publish a package.
env:
REPO_NAME: ${{ github.event.repository.name }}
AIKIDO_CLIENT_API_KEY: ${{ secrets.AIKIDO_CLIENT_API_KEY }}
run: >
aikido-api-client scan-release
"$REPO_NAME" "$GITHUB_SHA"
--apikey "$AIKIDO_CLIENT_API_KEY"
--fail-on-sast-scan --fail-on-iac-scan --fail-on-secrets-scan
Comment on lines +43 to +46

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Set a timeout for the Aikido gate

When an Aikido scan stays pending, this command has no scan or job timeout. The CLI offers only a poll interval, and GitHub applies a 360-minute default. Add timeout-minutes so a stalled scan fails in a useful time. Aikido CLI options, GitHub timeout default.

Useful? React with 👍 / 👎.

@cursor cursor Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit 51cb2e6 adds timeout-minutes: 15 on the aikido-gate job.
The line is .github/workflows/release.yaml line 15.
A stalled scan stops after 15 minutes.

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Set the gate severity to LOW

With the default CRITICAL threshold, new LOW, MEDIUM, or HIGH findings do not stop this release. The fail flags select scan types; they do not lower the severity threshold. Add --minimum-severity-level LOW if every new finding must block staging. Aikido CLI options.

Useful? React with 👍 / 👎.

@cursor cursor Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit 51cb2e6 adds --minimum-severity-level LOW.
The flag is .github/workflows/release.yaml line 47.
Client 1.0.17 accepts that flag.
The scan fails at severity LOW or above.

--minimum-severity-level LOW

build:
needs: [aikido-gate]

runs-on: ubuntu-latest
permissions:
contents: read
# OIDC lets this job stage the package.
id-token: write

env:
HYPHEN_PUBLIC_API_KEY: ${{ secrets.HYPHEN_PUBLIC_API_KEY }}
HYPHEN_API_KEY: ${{ secrets.HYPHEN_API_KEY }}
HYPHEN_APPLICATION_ID: ${{ secrets.HYPHEN_APPLICATION_ID }}
HYPHEN_ORGANIZATION_ID: ${{ secrets.HYPHEN_ORGANIZATION_ID }}
HYPHEN_LINK_DOMAIN: ${{ secrets.HYPHEN_LINK_DOMAIN }}

steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Expand Down
4 changes: 2 additions & 2 deletions DEFENSE_IN_DEPTH.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,15 +38,15 @@ Profile: npm library · public

## 5. npm publishing — npm libraries only
- [ ] OIDC trusted publishing configured **stage-only** on npmjs.com for the publish workflow — it can stage, never publish live (manual)
- [ ] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` (PR #170 pending)
- [x] `.github/workflows/release.yaml` packs then stages with `pnpm stage publish ./packed/*.tgz --no-git-checks` — PR #170
- [ ] Maintainer promotes staged versions with 2FA (manual)
- [ ] Drydock connected — staged releases reviewed before promotion (manual)
- [ ] No direct publish rights: package requires 2FA and disallows tokens (manual)
- [x] `package.json` `repository.url` accurate so provenance maps to this repo — verified 2026-10-08

## 6. Security tooling
- [x] Aikido runs on every build — verified 2026-10-08
- [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release`
- [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release` (PR #171 pending)

@gemini-code-assist gemini-code-assist Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The pull request title and description indicate that the aikido-gate job is being added to the release workflow in this PR. However, the workflow file .github/workflows/release.yaml is not included in the changes, and this tracking item is still marked as (PR pending). Please commit the workflow changes in this PR, or update the PR title and description to clarify that this is only a tracking document update.

@cursor cursor Bot Oct 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow change is in commit d5f9d3a.
.github/workflows/release.yaml line 12 adds the aikido-gate job.
Line 47 sets needs: [aikido-gate] on the build job.
Commit 78655fc records the pull request number on the checklist.
The item stays open until this pull request merges.

- [ ] Socket reviews every PR that changes dependencies

## 7. Repository lockdown
Expand Down
Loading