Repository navigation
root - chore: defense - gate releases with Aikido - #171
Conversation
The aikido-gate job runs scan-release. The build job waits for that scan. OIDC stays on the build job only. The checklist records pull request 170 as done. Co-authored-by: Jared Wray <me@jaredwray.com>
The checklist names the open pull request. Co-authored-by: Jared Wray <me@jaredwray.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the DEFENSE_IN_DEPTH.md tracking document to mark the release workflow staging task as completed and notes that the Aikido release gate is pending. Feedback was provided regarding a discrepancy between the PR description and the actual changes, as the release workflow file itself was not modified in this PR.
| ## 6. Security tooling | ||
| - [x] Aikido runs on every build — verified 2026-10-08 | ||
| - [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release` | ||
| - [ ] Aikido release gate: the release workflow's stage-publish job `needs:` a passing `scan-release` (PR #171 pending) |
There was a problem hiding this comment.
The pull request title and description indicate that the aikido-gate job is being added to the release workflow in this PR. However, the workflow file .github/workflows/release.yaml is not included in the changes, and this tracking item is still marked as (PR pending). Please commit the workflow changes in this PR, or update the PR title and description to clarify that this is only a tracking document update.
There was a problem hiding this comment.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #171 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 9 9
Lines 639 639
Branches 146 146
=========================================
Hits 639 639 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d5f9d3a382
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| - name: Install Aikido CI client | ||
| # zizmor: ignore[adhoc-packages] pinned Aikido CI client for the release gate | ||
| run: sfw npm install --global @aikidosec/ci-api-client@1.0.17 |
There was a problem hiding this comment.
This release job uses npm to install the client. The repository requires pnpm for all package management commands. Add pnpm and use it here.
AGENTS.md reference: AGENTS.md:L3-L3
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Line 33 keeps sfw npm install --global @aikidosec/ci-api-client@1.0.17.
The skill template uses that command.
The Aikido install guide uses the same npm command.
setup-node puts that global binary on PATH.
pnpm bin -g returns an empty path here, so a global pnpm install can omit the client from PATH.
| aikido-api-client scan-release | ||
| "$REPO_NAME" "$GITHUB_SHA" | ||
| --apikey "$AIKIDO_CLIENT_API_KEY" | ||
| --fail-on-sast-scan --fail-on-iac-scan --fail-on-secrets-scan |
There was a problem hiding this comment.
When an Aikido scan stays pending, this command has no scan or job timeout. The CLI offers only a poll interval, and GitHub applies a 360-minute default. Add timeout-minutes so a stalled scan fails in a useful time. Aikido CLI options, GitHub timeout default.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Commit 51cb2e6 adds timeout-minutes: 15 on the aikido-gate job.
The line is .github/workflows/release.yaml line 15.
A stalled scan stops after 15 minutes.
| aikido-api-client scan-release | ||
| "$REPO_NAME" "$GITHUB_SHA" | ||
| --apikey "$AIKIDO_CLIENT_API_KEY" | ||
| --fail-on-sast-scan --fail-on-iac-scan --fail-on-secrets-scan |
There was a problem hiding this comment.
With the default CRITICAL threshold, new LOW, MEDIUM, or HIGH findings do not stop this release. The fail flags select scan types; they do not lower the severity threshold. Add --minimum-severity-level LOW if every new finding must block staging. Aikido CLI options.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Commit 51cb2e6 adds --minimum-severity-level LOW.
The flag is .github/workflows/release.yaml line 47.
Client 1.0.17 accepts that flag.
The scan fails at severity LOW or above.
The aikido-gate job stops after 15 minutes. The scan fails at severity LOW or above. Co-authored-by: Jared Wray <me@jaredwray.com>
2 participants
Please check if the PR fulfills these requirements
This chore changes the release workflow only. No new test is required.
What kind of change does this PR introduce?
Chore. The release build waits for an Aikido scan.
Summary
Section 6 adds an
aikido-gatejob to the release workflow.The job runs
aikido-api-client scan-releasewith@aikidosec/ci-api-client@1.0.17.The
buildjob needs that gate, so the stage publish waits for a clean scan.id-token: writestays on thebuildjob only.The client pin matches the skill template.
The scan reads
secrets.AIKIDO_CLIENT_API_KEY. Add that Actions secret before the next release. The key comes from the Aikido CI settings. The key cannot publish a package.Status
DEFENSE_IN_DEPTH.md:.github/workflows/release.yamlpacks then stages withpnpm stage publish ./packed/*.tgz --no-git-checks→ PR root - chore: defense - stage npm publishes #170needs:a passingscan-release→ (PR root - chore: defense - gate releases with Aikido #171 pending)These items stay open. Each one is manual:
Verification
Reference
defense-in-depth-nodejs § 6