From 1f552e0300f556384758851877e6466859425056 Mon Sep 17 00:00:00 2001 From: Rob Bos Date: Sat, 23 May 2026 22:09:03 +0200 Subject: [PATCH 1/3] feat: add secure input scanning and CODEOWNERS protection - Add secure-inputs.yml: scans PR/issue/comment events for attack vectors (hidden Unicode, shell injection, template injection, prompt injection). Calls devops-actions/.github reusable workflow. - Add .github/CODEOWNERS (where applicable): requires @rajbos review for changes to .github/workflows/ and AI instruction files (copilot-instructions.md, AGENTS.md, CLAUDE.md, .cursor/, etc.). Reference: supply chain attack research 2025, Pillar Security Rules File Backdoor. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/secure-inputs.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/secure-inputs.yml diff --git a/.github/workflows/secure-inputs.yml b/.github/workflows/secure-inputs.yml new file mode 100644 index 0000000..4be3a6a --- /dev/null +++ b/.github/workflows/secure-inputs.yml @@ -0,0 +1,26 @@ +name: Secure Input Scan + +# Scans pull requests, issues, and comments for known attack vectors: +# - Hidden Unicode characters incl. Unicode Tag Characters (AI instruction embedding) +# - Bidirectional text overrides (Trojan Source) +# - Shell / template / script injection +# - Prompt injection targeting AI agents in CI/CD pipelines +# See: devops-actions/.github/.github/workflows/secure-inputs.yml +on: + pull_request: + types: [opened, edited, synchronize] + + issues: + types: [opened, edited] + + issue_comment: + types: [created, edited] + +permissions: + contents: read + +jobs: + scan-inputs: + uses: devops-actions/.github/.github/workflows/secure-inputs.yml@main + permissions: + contents: read From bbe8300e7b862930655b965a7871590e8dd5919b Mon Sep 17 00:00:00 2001 From: Rob Bos Date: Sat, 23 May 2026 22:37:45 +0200 Subject: [PATCH 2/3] fix: pin reusable workflow to SHA instead of @main Use immutable commit SHA b77cea6 for the secure-inputs reusable workflow reference to prevent mutable tag attacks (supply chain security best practice). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/secure-inputs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secure-inputs.yml b/.github/workflows/secure-inputs.yml index 4be3a6a..7b4b98c 100644 --- a/.github/workflows/secure-inputs.yml +++ b/.github/workflows/secure-inputs.yml @@ -21,6 +21,6 @@ permissions: jobs: scan-inputs: - uses: devops-actions/.github/.github/workflows/secure-inputs.yml@main + uses: devops-actions/.github/.github/workflows/secure-inputs.yml@b77cea6 permissions: contents: read From 36d847c55510464eded3e273df8731e6edbfaccf Mon Sep 17 00:00:00 2001 From: Rob Bos Date: Sat, 23 May 2026 22:40:47 +0200 Subject: [PATCH 3/3] ci: pin reusable workflow refs to full SHA instead of @main Use full 40-char SHA with # main comment for secure, tamper-proof references to the centralized reusable workflows in devops-actions/.github. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/secure-inputs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/secure-inputs.yml b/.github/workflows/secure-inputs.yml index 7b4b98c..1eb022d 100644 --- a/.github/workflows/secure-inputs.yml +++ b/.github/workflows/secure-inputs.yml @@ -21,6 +21,6 @@ permissions: jobs: scan-inputs: - uses: devops-actions/.github/.github/workflows/secure-inputs.yml@b77cea6 + uses: devops-actions/.github/.github/workflows/secure-inputs.yml@b77cea6d7ba1cd4e001581783cc592bbb63ce46d # main permissions: contents: read