fix(security): validate actions lock integrity

[hyperpolymath]

Makes actions.lock validation fail closed without producing contradictory inline-SHA remediation. Validates workflow association, repository identities, case-sensitive refs, and transitive dependencies, while keeping gh actions-lock authoritative. Verification: 97 targeted tests pass; authoritative gh actions-lock --verify exits 0; full suite is 1469 tests with the same two pre-existing Strategist/Sensor failures outside this change.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: c4e01e15-59cd-450c-83f6-97e4756c4c6d

📥 Commits

Reviewing files that changed from the base of the PR and between 5ec5e9f and 184ac71.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• lib/rules/actions_lock.ex
• lib/rules/rules.ex
• lib/rules/workflow_audit.ex
• lib/rules/workflow_hardening.ex
• test/rules/actions_lock_test.exs
• test/workflow_audit_test.exs
• test/workflow_hardening_test.exs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (63)

• GitHub Check: scan / gitleaks
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Licence consistency
• GitHub Check: scan / shell-secrets
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Debt ratchet
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: Container Security (Trivy) (deploy/Containerfile)
• GitHub Check: analyze (actions, none)
• GitHub Check: Generate SBOM
• GitHub Check: Semgrep SAST
• GitHub Check: CodeQL SAST (actions)
• GitHub Check: Secret Detection (TruffleHog)
• GitHub Check: Generate Rust SBOM
• GitHub Check: Secret Detection (Gitleaks)
• GitHub Check: Rust Dependency Audit
• GitHub Check: CodeQL Analysis (actions)
• GitHub Check: Secret Detection
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Rust License & Ban Check
• GitHub Check: analyze (javascript-typescript, none)
• GitHub Check: Groove manifest check
• GitHub Check: Rust Dependency Audit
• GitHub Check: Rust License & Ban Check
• GitHub Check: License Compliance Check
• GitHub Check: Validate K9 contracts
• GitHub Check: Aspect — Rule Module Coverage
• GitHub Check: Build AsciiDoc
• GitHub Check: E2E — Elixir Scanner Pipeline
• GitHub Check: stress-test
• GitHub Check: Semgrep SAST
• GitHub Check: E2E — Rust CLI Scan
• GitHub Check: lint
• GitHub Check: docs
• GitHub Check: Build Test Images
• GitHub Check: criterion + baseline gate
• GitHub Check: Clippy
• GitHub Check: Rust Check & Clippy
• GitHub Check: Validate Documentation
• GitHub Check: Detect Haskell tree
• GitHub Check: Test
• GitHub Check: Format
• GitHub Check: Check
• GitHub Check: k9iser manifest + build
• GitHub Check: Cargo check + clippy + fmt
• GitHub Check: Rust Format
• GitHub Check: ts_check
• GitHub Check: check
• GitHub Check: Build AsciiDoc
• GitHub Check: Prepare Release
• GitHub Check: Validate Documentation
• GitHub Check: lint
• GitHub Check: docs

🔇 Additional comments (4)

lib/rules/actions_lock.ex (1)

1-491: LGTM!

test/rules/actions_lock_test.exs (1)

1-295: LGTM!

lib/rules/workflow_hardening.ex (1)

291-306: LGTM!

Also applies to: 308-326, 328-340

test/workflow_hardening_test.exs (1)

19-38: LGTM!

Also applies to: 159-174, 176-197, 199-207

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added support for validating actions.lock files, including workflow-specific action pinning and dependency tracking.
  • Workflow scans now recognise valid locked actions and suppress unpinned-action warnings where appropriate.
  • Added clear findings for malformed, incomplete, contradictory or unsupported lockfiles, with regeneration guidance.

• Bug Fixes

  • Improved matching for repository names regardless of capitalisation while preserving ref sensitivity.
  • Added validation for transitive dependencies and workflow-specific lock entries.

• Tests

  • Expanded coverage for valid, invalid and edge-case lockfile scenarios.

Walkthrough

Adds strict parsing for gh actions-lock v0.0.2 lockfiles. Workflow audit and WH004 now use workflow-scoped lock data to accept pinned actions and report invalid lockfiles. Tests cover parsing, identity checks, transitive dependencies, path scoping, and failure handling.

Changes

Actions lock validation

Layer / File(s)	Summary
Lock format parser and validation lib/rules/actions_lock.ex, test/rules/actions_lock_test.exs	Adds the ActionsLock struct and public APIs. The parser validates versions, workflows, dependency fields, repository identities, commits, references, and transitive dependencies.
Workflow audit lock integration lib/rules/workflow_audit.ex, lib/rules/rules.ex, test/workflow_audit_test.exs, test/rules/actions_lock_test.exs	Workflow audit now uses parsed, workflow-scoped lock data. Invalid locks produce invalid_actions_lock findings. Pinned actions produce no finding.
WH004 lock integration lib/rules/workflow_hardening.ex, test/workflow_hardening_test.exs	WH004 reads and validates actions.lock. It suppresses findings only for actions pinned for the current workflow and reports invalid lockfiles with regeneration guidance.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to 184ac

The PR makes actions.lock validation fail closed and strengthens workflow and dependency checks. With the reported verification passing, no actionable merge-blocking risk remains beyond normal checks and review.

Poem

I am a rabbit guarding the lock,
Parsing each ref and key in the block.
Bad SHAs hop out,
Good pins quiet doubt,
While workflows march safely around the clock.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 7 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: validating actions.lock integrity for security.
Description check	✅ Passed	The description directly covers fail-closed validation, workflow and repository checks, transitive dependencies, authoritative lockfile verification, and test results.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}