[ACP-HARDEN-260] GitHub Actions supply-chain policyをfull-SHA基準で強化する

[ootakazuhiko]

Parent: #3655
Depends on: —
Blocks: #3640
Codex lane: ci/actions-supply-chain-hardening

背景

現行workflow／composite actionにはactions/checkout@v4、actions/setup-node@v4等のmoving tag参照が残る。Private Matchでは、第三者Actionのfull commit SHA、release tag comment、persist-credentials: false、minimum permissions、bounded timeout、untrusted PR laneのnetwork／write制約を標準化した。

Assurance Control Plane自身のCI supply chainは、consumerへ要求する水準以上に監査可能である必要がある。

目的

repository-wideのActions supply-chain policy、validator、migrationを追加し、workflowとcomposite actionをfail closedで検査する。

Codex CLI preflight

• all .github/workflows/*.yml
• .github/actions/**/action.yml
• reusable workflows
• CI policy／automation permission docs
• Dependabot／release update policy
• branch protection required checks
• Context Pack／Boundary Map

Policy requirements

最低限:

• third-party uses:は40桁full commit SHAへpinする。
• pin行へhuman-readable release tag commentを付ける。
• actions/checkoutは原則persist-credentials: false。
• workflow／job permissionsを明示し、最小権限にする。
• jobへbounded timeout-minutesを要求する。
• untrusted pull_request laneでwrite token、secret、artifact publication、外部networkを使用しない。
• pull_request_targetは別policyで厳格に制限し、untrusted head checkoutとの組合せを禁止する。
• local composite／reusable actionを再帰的に検査する。
• moving tag updateはreview済みbot／human PR経由に限定する。

実装タスク

• workflow／composite／reusable action inventoryを生成する。
• scripts/ci/check-actions-supply-chain.mjs等のoffline validatorを追加する。
• full SHA、tag comment、checkout credential、permissions、timeout、event trust boundaryを検査する。
• YAML anchor／expression／local action／nested compositeを正しく扱う。
• violationにstable code、file、job、stepを付ける。
• current workflowsをrisk単位の小さなcommitで移行する。
• SHAとtagの対応をtrusted update時に検証する手順をdocsへ追加する。通常PR validatorはnetwork不要とする。
• Dependabot／Renovateまたは手動update runbookでpin更新方法を定義する。
• fork PR、pull_request_target、workflow_run、issue_comment、workflow_dispatchのthreat matrixを追加する。
• verify-lite／required gateへvalidatorを組み込む。

Acceptance criteria

• third-party moving tagが0件、または明示的reviewed exception contractがある。
• actions/checkoutのcredential persistenceが全trusted／untrusted laneで明示される。
• permissionsとtimeout欠落を検出する。
• nested composite action内のfloating refを検出する。
• untrusted PR + write permission／secret／pull_request_target unsafe checkoutを検出する。
• valid workflow fixtureはpassし、各violation fixtureはstable codeでfailする。
• existing required check名を不用意に変更しない。

Validation

• actionlint
• validator positive／negative fixtures
• all workflow／composite scan
• required check compatibility audit
• pnpm -s run check:doc-consistency
• pnpm -s run verify:lite
• representative workflow exact-head CI

非目標

• cloud provider選定
• OIDC federationの全面実装
• GitHub organization policyの自動変更
• Marketplace publication

Stop condition

• Draft PR
• no required-check name drift unless explicitly approved
• exact-head CI success
• unresolved review threads 0
• worktree clean

[ootakazuhiko]

Additional current-run observation

Main-line Nightly Matrix for merge commit bba9b6846608359b87ed5393cb208e321f3ba8af completed successfully:

https://github.com/itdojp/ae-framework/actions/runs/30309518817

All 14 jobs succeeded, but GitHub emitted advisory annotations that the following JavaScript Actions target the deprecated Node.js 20 action runtime and are currently forced onto Node.js 24:

• actions/checkout@v4
• actions/setup-node@v4

This did not affect the application Node 20/22 matrix results and is not a blocker for #3668 or #3657. Please include action-runtime compatibility and migration in the #3664 inventory and remediation plan.

[ootakazuhiko]

Parallel review supplement — required-check identity and concurrency (2026-09-07)

Review origin: #3675. Keep this as future #3664 scope; do not edit active PR #3674 or frozen PR #3673 from this review.

At inspected main c5da6115638fdbfeebbc458b39fa6916db66afb0, branch metadata lists the required context gate with App ID 15368. The coverage workflow defines a generic jobs.gate and the authority normalizer currently matches required policy by name/App ID. A branch-protection context is not equivalent to the full workflow, nor to every security lane. Source: .github/workflows/coverage-check.yml, scripts/agents/github-work-state-lib.mjs. GitHub recommends unique job names across workflows to avoid ambiguous required-check results: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches .

Please include in the existing inventory/migration plan:

1. Map context → workflow path/ID → job identity → event/mode → enforcement behavior; report duplicate names and missing underlying expected jobs. Work with [ACP-REVIEW-410] Authority consumerの対象bindingとCheckRun/WorkflowRun IDを明確化する #3676/[ACP-REVIEW-420] Scoped acceptance planとbounded CI observationで待機・失敗・取得不能を分離する #3677 rather than invent another ID model.
2. Do not rename live required contexts in one step. Produce a compatibility/migration plan with old/new contexts, validation, explicit owner-approved branch-protection change and rollback. This review authorizes no settings change.
3. Analyze concurrency at repository scope, including caller, reusable workflow and standalone invocation. Keep [MAIN-HEALTH-SEC-002] Restore dependency security gates #3673's existing standalone/reusable SBOM review as its operator's responsibility. Add replay fixtures for collisions and for intentionally superseded same-PR runs; do not blanket-disable cancellation to conceal an unsafe namespace.
4. Inventory action JavaScript runtime separately from application Node matrix and package engines; a warning or a version bump is not by itself compatibility evidence.
5. Distinguish scan execution, finding counts, severity policy and SARIF upload. Successful SARIF generation/upload alone must not be advertised as a clean or enforced security result.

Implement offline validators first and retain the current risk-based/report-only-first boundary until an explicit migration is approved. No new universal gate or required-context change should be introduced as a side effect of full-SHA pinning.