feat: add Security Suite workflow (one-stop, ruleset-enforceable) by dkastl · Pull Request #71 · geolonia/.github

dkastl · 2026-06-26T02:29:02Z

What

Adds security-suite.yml: a single entry point for Geolonia's per-PR security checks, designed to be enforced org-wide as a required workflow (Repository Rulesets) so every repo gets the same gate with no per-repo workflow file to maintain.

It fans out to the existing org reusable scanners plus a new zizmor job:

Job	Tool	Catches
`supply-chain`	bumblebee	compromised packages vs. threat-intel catalogs
`secret-leak`	betterleaks	secrets in the PR diff
`action-pinning`	pinact	unpinned / mismatched GitHub Actions
`actions-audit`	zizmor	`pull_request_target` / `workflow_run` with untrusted checkout, template injection, excessive permissions, credential persistence

Why

We have several good reusable security workflows, but asking every repo to wire up each one leads to partial adoption (see geolonia-operations#195). Consolidating into one suite + enforcing via an org ruleset makes security the default with zero developer setup, and lets us add a scanner once centrally and have every repo pick it up.

Required follow-up (org settings, manual)

This PR only adds the workflow. To enforce it, create an organization ruleset:

Org Settings -> Rules -> Rulesets -> New ruleset -> New branch ruleset
Target: all repos (or by custom property), branch main
Rule: Require workflows to pass before merging -> add workflow
geolonia/.github / .github/workflows/security-suite.yml @ a pinned ref (tag)
Start in Evaluate mode to observe, then switch to Active

geolonia/.github is public, so the workflow can run on public, internal, and private repos. Org rulesets incl. require-workflows are GA on the Team plan (2025-06).

Design notes

Required-workflow constraint: the three reusables are referenced by full path + pinned SHA (@eb33e7f # v1.17.1), because a required workflow may not use local ./ reusable paths.
Least privilege: workflow default is contents: read; only the jobs that comment / open issues get write, scoped per job. (zizmor confirms: no findings on this file.)
Private-repo portable: zizmor uses advanced-security: false + annotations: true so it does not depend on GHAS / SARIF upload, which is unavailable on private repos without a license.
Rollout ramp: zizmor is continue-on-error: true (warn-only). Flip to enforce by removing that line once the org is clean.
No secrets: none of the reusables declare workflow_call secrets, so no secrets: inherit.

After the ruleset is live (separate PR)

Remove the now-redundant per-repo caller workflows (bumblebee / betterleaks / pinact) so scanners do not double-run.

Part of geolonia-operations#196. Umbrella: geolonia-operations#195.

Validation

actionlint clean
zizmor self-audit: no findings

Summary by CodeRabbit

Security
- Added a new “Security Suite” GitHub Actions workflow for pull requests targeting the main branch.
- Runs multiple automated scanners (supply-chain, secret leakage, and Actions security checks) with least-privilege settings.
- Produces a single consolidated Markdown summary and updates/creates one PR comment via a fixed marker.
- Reports findings as warn-only during the rollout ramp (non-blocking), while consolidating statuses into an overall callout.

coderabbitai · 2026-06-26T02:29:10Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Adds a new security-suite pull request workflow for main, runs reusable scanners plus an inline zizmor audit, and updates one consolidated PR comment with the combined status.

Changes

Security suite workflow

Layer / File(s)	Summary
Workflow shell and trigger `.github/workflows/security-suite.yml`	Adds the workflow metadata, pull request trigger on `main`, and workflow-level `contents: read` permission.
Reusable scanner jobs `.github/workflows/security-suite.yml`	Defines the `supply-chain`, `secret-leak`, and `action-pinning` reusable scanner jobs, plus the inline `actions-audit` job with its pinned action and status output mapping.
Consolidated report job `.github/workflows/security-suite.yml`	Aggregates scanner outputs, selects an overall callout, and updates or creates a single fixed-marker PR comment with the combined status.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~40 minutes

Possibly related issues

geolonia/geolonia-operations#195 — Describes the same security-suite workflow pattern and scanner set.
geolonia/geolonia-operations#196 — Matches the consolidated security suite workflow with bumblebee, betterleaks, pinact, and zizmor.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and clearly summarizes the main change: adding the Security Suite workflow.
Description check	✅ Passed	The description is mostly complete and covers the summary, rationale, validation, and related issues, even though it uses custom headings instead of the template.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/security-suite

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-06-26T02:29:10Z

Bumblebee Supply-Chain Scan (`v0.1.2`)

OK No exposure-catalog matches in this checkout.

github-actions · 2026-06-26T02:29:14Z

Secret Leak Check

OK No secrets detected in this PR's diff.

github-actions · 2026-06-26T02:29:16Z

Secret Leak Check

OK No secrets detected in this PR's diff.

github-actions · 2026-06-26T02:31:23Z

Bumblebee Supply-Chain Scan (`v0.1.2`)

OK No exposure-catalog matches in this checkout.

github-actions · 2026-06-26T02:31:26Z

Secret Leak Check

OK No secrets detected in this PR's diff.

github-actions · 2026-06-26T02:31:28Z

Secret Leak Check

OK No secrets detected in this PR's diff.

github-actions · 2026-06-26T04:36:53Z

Secret Leak Check

OK No secrets detected in this PR's diff.

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/security-suite.yml:
- Line 52: The pinned reusable workflow refs in the security-suite workflow are
using SHA pins with a free-text note, which causes pinact to fail because it
cannot verify a version comment. Update the reusable workflow references in the
security-suite workflow, including the geolonia reusable bumblebee scan and the
action-pinning ref, to use a released tag with a proper version comment once
available; if the tag is not yet released, add the appropriate pinact ignore
entry or otherwise align the refs with pinact’s expected version-comment format.
- Around line 206-213: The new-comment branch in the report step lacks
repository context, so `gh pr comment` can fail when there is no checkout.
Update the `else` path in the consolidated comment logic to pass explicit repo
context using either `--repo` with `gh pr comment` or switch it to the same `gh
api` style used in the PATCH branch; reference the `report` job, `EXISTING`,
`REPO`, and `PR_NUMBER` handling to keep the update and create paths consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 01d2696c-be3c-4767-8c2b-e9d8bb937397

📥 Commits

Reviewing files that changed from the base of the PR and between 3149bce and efea02b.

📒 Files selected for processing (1)

.github/workflows/security-suite.yml

github-actions · 2026-06-26T04:54:59Z

Secret Leak Check

OK No secrets detected in this PR's diff.

github-actions · 2026-06-26T04:59:12Z

Secret Leak Check

OK No secrets detected in this PR's diff.

Single entry point that fans out to the org security scanners (bumblebee, betterleaks, pinact) plus an inline zizmor GitHub Actions static-analysis job. Designed to run as an organization required workflow so every repo gets the same gate with no per-repo workflow file. zizmor runs warn-only during rollout. Part of geolonia-operations#196.

Run the scanners in report-mode: summary (quiet) and add a report job that posts a single consolidated comment with a status table for all four checks, instead of one comment per scanner. Temporarily references the report-mode reusables at the #72 branch SHA; bump to the release tag once #72 ships. Part of geolonia-operations#196.

A called reusable can only downgrade the caller's GITHUB_TOKEN, not elevate it. Reducing the summary-mode caller jobs to contents:read made the reusables' declared pull-requests/issues:write exceed the grant, causing a workflow startup_failure. Grant the declared permissions.

The report job has no checkout, so gh pr comment cannot infer the repo from git context. Pass --repo explicitly (the gh api calls already do).

#72 released as v1.18.0 (report-mode + outputs). Bump the suite's reusable refs from the pre-release branch SHA to the v1.18.0 tag, so the action-pinning check passes.

github-actions · 2026-06-26T05:53:30Z

Secret Leak Check

OK No secrets detected in this PR's diff.

github-actions · 2026-06-26T05:53:45Z

🛡️ Security suite

Check	Result
✅ Supply chain · `bumblebee`	No exposure matches
✅ Secrets · `betterleaks`	No secrets in diff
✅ Action pinning · `pinact`	All actions pinned
⚠️ Actions audit · `zizmor`	Findings (warn-only; see annotations)

Warning

Warnings only. These do not block the PR, but please review them.

_{Updated for 954acb2 · workflow run}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/security-suite.yml:
- Around line 40-46: Serialize the PR workflow run before the marker comment is
created so only one run can check/post the consolidated comment at a time.
Update the security-suite workflow job that handles the marker comment to use a
per-PR concurrency key (for example based on the pull_request number) around the
relevant comment-posting/update steps, and apply the same change to the other
comment-related sections referenced by the workflow so overlapping runs cannot
create duplicate “single” comments.
- Around line 114-119: The comment-posting step in the security-suite workflow
should be skipped for forked pull requests because the default token is
read-only and `gh api`/`gh pr comment` will fail. Update the job around the
“Build and post consolidated comment” step to gate comment writes on a non-fork
PR check using the PR event context, or move the commenting logic into a trusted
`pull_request_target` or follow-up workflow while keeping the rest of the job
intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 609896f1-93e2-4c60-ba9e-f0200e10311a

📥 Commits

Reviewing files that changed from the base of the PR and between d840554 and ba10520.

📒 Files selected for processing (1)

.github/workflows/security-suite.yml

The marker lookup used 'gh api --paginate --slurp --jq', but --slurp cannot be combined with --jq, so the call always errored, got swallowed by '|| true', and the report job posted a new comment every run instead of updating in place. Use plain --paginate + .[].

github-actions · 2026-06-26T06:00:47Z

Secret Leak Check

OK No secrets detected in this PR's diff.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/security-suite.yml:
- Around line 210-213: The comment lookup in the workflow currently hides real
gh api/jq failures by forcing EXISTING to empty with the fallback, which can
lead to duplicate consolidated comments. Update the EXISTING assignment in the
comment lookup step to preserve the “no matching comment” empty result while
allowing genuine API/auth/query errors to fail the job, using the gh api call
and jq filter around the existing MARKER-based lookup logic.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 64a0bedb-e006-494e-840a-be01dab1c6d8

📥 Commits

Reviewing files that changed from the base of the PR and between ba10520 and dac2585.

📒 Files selected for processing (1)

.github/workflows/security-suite.yml

- concurrency group per PR so overlapping runs cannot double-post - comment lookup is strict (real API errors fail the job; empty = no match) instead of masking failures with || true - posting degrades gracefully (warn, not fail) when the token is read-only on fork PRs, so the suite does not fail just to comment

github-actions · 2026-06-26T06:09:45Z

Secret Leak Check

OK No secrets detected in this PR's diff.

dkastl force-pushed the feat/security-suite branch from b37317f to 3149bce Compare June 26, 2026 02:31

dkastl marked this pull request as ready for review June 26, 2026 02:35

coderabbitai Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread .github/workflows/security-suite.yml Outdated

Comment thread .github/workflows/security-suite.yml

dkastl added 5 commits June 26, 2026 14:46

fix: pass --repo to gh pr comment in the report job

208e1fb

The report job has no checkout, so gh pr comment cannot infer the repo from git context. Pass --repo explicitly (the gh api calls already do).

chore: pin Security Suite reusables to v1.18.0

ba10520

#72 released as v1.18.0 (report-mode + outputs). Bump the suite's reusable refs from the pre-release branch SHA to the v1.18.0 tag, so the action-pinning check passes.

dkastl force-pushed the feat/security-suite branch from 22fac67 to ba10520 Compare June 26, 2026 05:53

coderabbitai Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread .github/workflows/security-suite.yml

Comment thread .github/workflows/security-suite.yml

geolonia deleted a comment from github-actions Bot Jun 26, 2026

coderabbitai Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread .github/workflows/security-suite.yml Outdated

dkastl merged commit c98b846 into main Jun 26, 2026
8 checks passed

dkastl deleted the feat/security-suite branch June 26, 2026 06:14

Uh oh!

Conversation

dkastl commented Jun 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Required follow-up (org settings, manual)

Design notes

After the ruleset is live (separate PR)

Validation

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Uh oh!

github-actions Bot commented Jun 26, 2026

Bumblebee Supply-Chain Scan (v0.1.2)

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

github-actions Bot commented Jun 26, 2026

Bumblebee Supply-Chain Scan (v0.1.2)

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

github-actions Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ Security suite

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jun 26, 2026

Secret Leak Check

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

dkastl commented Jun 26, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 26, 2026 •

edited

Loading

Bumblebee Supply-Chain Scan (`v0.1.2`)

Bumblebee Supply-Chain Scan (`v0.1.2`)

github-actions Bot commented Jun 26, 2026 •

edited

Loading