From bbece3fd6efcd6f44d3d9c3c87c42c4ef10f0d10 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 14 Sep 2026 17:31:27 +0100 Subject: [PATCH 1/3] fix(ci): repair unparseable scorecard.yml and restore the missing contents: read Two defects, and fixing only the first would look like a cure while changing nothing. 1. `permissions: read-all` is a SCALAR, so the indented `actions: read` beneath it is a mapping entry under a scalar: invalid YAML. GitHub never parsed the file, the run emitted zero jobs, and the Scorecard check never appeared. The gate was ABSENT, not red. 2. The `analysis` job declares its own `permissions:` block naming only `security-events` and `id-token`. A job-level block REPLACES the workflow-level one rather than merging with it, so the reusable workflow was being called without `contents: read` and could not check out. Deleting the orphan key alone would yield a file that parses and still emits no check. Adds `contents: read` to the job block, matching aerie#76 (merged 2026-09-13), which carries exactly these three job permissions. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b5e21ca..1d615ea 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -7,11 +7,11 @@ on: - cron: '23 4 * * 1' permissions: read-all - actions: read jobs: analysis: permissions: + contents: read security-events: write id-token: write uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 From 11e4fb5aa638fb7f3b2a72d1b905c1142e31444d Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 14 Sep 2026 21:46:34 +0100 Subject: [PATCH 2/3] fix(ci): grant actions: read to the Scorecard caller job The job-level `permissions:` block REPLACES the workflow-level block, so the reusable workflow's own `actions: read` cannot elevate the caller's token. Without it the caller's effective `actions` permission is `none`, and Scorecard's Packaging check (Actions.ListWorkflowRunsByFileName) can error. Caught by CodeRabbit on palimpsest-license#151; verified against the whole family: 11 of 13 scorecard.yml callers omit it, including aerie which is already on main. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/scorecard.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 1d615ea..0d9966d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -11,6 +11,7 @@ permissions: read-all jobs: analysis: permissions: + actions: read contents: read security-events: write id-token: write From 688fb0e1e0a136c15fd25fba30399fb0affcf44a Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Tue, 15 Sep 2026 15:22:31 +0000 Subject: [PATCH 3/3] fix(security): prevent false positives in repository scans --- docs/proof-debt.adoc | 25 +++++++++++++++++++++++++ tests/aspect/security_test.mjs | 10 +++++++--- 2 files changed, 32 insertions(+), 3 deletions(-) create mode 100644 docs/proof-debt.adoc diff --git a/docs/proof-debt.adoc b/docs/proof-debt.adoc new file mode 100644 index 0000000..d2bb869 --- /dev/null +++ b/docs/proof-debt.adoc @@ -0,0 +1,25 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 += Proof Debt + +== (a) Discharged in this repository + +* None. + +== (b) Budgeted — tested with a refutation budget + +* None. + +== (c) Necessary axioms + +* None. + +== (d) Debt — actively to be closed + +* None. + +== Scanner signatures that are not proof debt + +`src-gossamer/src/provenance/commands.rs` contains the strings +`unsafePerformIO` and `unsafeCoerce` as inert signatures for PanLL's provenance +scanner. They are data used to detect unsound constructs in inspected source; +PanLL does not execute or invoke either escape hatch. diff --git a/tests/aspect/security_test.mjs b/tests/aspect/security_test.mjs index 2ebeb93..f967c83 100644 --- a/tests/aspect/security_test.mjs +++ b/tests/aspect/security_test.mjs @@ -253,6 +253,10 @@ Deno.test("Aspect/Security: AntiCrash.checkSecurityConstraints flags eval() usag // 5. Redaction Engine — API keys and secrets must not leave the boundary // ============================================================================ +function syntheticToken(prefix, length) { + return prefix + "A".repeat(length); +} + Deno.test("Aspect/Security: redactText strips Anthropic API keys (sk-ant prefix)", () => { const text = "My API key is sk-ant-api03-ABCDEFGHIJKLMNOPQRSTUVWXYZ"; const result = redactText(text, builtInPatterns); @@ -260,13 +264,13 @@ Deno.test("Aspect/Security: redactText strips Anthropic API keys (sk-ant prefix) }); Deno.test("Aspect/Security: redactText strips OpenAI API keys (sk- prefix)", () => { - const text = "OpenAI key: sk-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef123456"; + const text = `OpenAI key: ${syntheticToken("sk-", 38)}`; const result = redactText(text, builtInPatterns); - assert(!result.includes("sk-ABCDEFGHIJK"), "OpenAI key must be redacted"); + assert(!result.includes(syntheticToken("sk-", 11)), "OpenAI key must be redacted"); }); Deno.test("Aspect/Security: redactText strips GitHub tokens (ghp_ prefix)", () => { - const text = "GitHub token: ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ12345"; + const text = `GitHub token: ${syntheticToken("ghp_", 35)}`; const result = redactText(text, builtInPatterns); assert(!result.includes("ghp_"), "GitHub token must be redacted"); });