From 7aa7abc13e4ed2a0908720a236f2507b37283082 Mon Sep 17 00:00:00 2001 From: xormania <127287135+xormania@users.noreply.github.com> Date: Tue, 1 Sep 2026 13:43:47 -0400 Subject: [PATCH 1/5] repo: workflow and MCP hardening from the security audit Findings applied from the independent audit (CHANGES verdict): workflow-level permissions contents:read; persist-credentials false on checkout; every action pinned to a reviewed commit SHA with its tag in a comment; Serena pinned in .mcp.json to the audited git commit instead of floating uvx resolution. Finding: [P1] workflows ran with default token permissions Finding: [P1] .mcp.json launched unversioned uvx serena Finding: [P2] mutable action tags across all repositories Verified: python yaml.safe_load + json.load on the changed files Source: original Co-Authored-By: GPT-5 Codex Co-Authored-By: Claude Fable 5 Reviewed-by: GPT-5 Codex Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ --- .github/workflows/ci.yml | 6 +++++- .mcp.json | 11 ++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f414bb8..457b587 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,11 +3,15 @@ on: pull_request: push: branches: [dev, main] +permissions: + contents: read jobs: ci: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + with: + persist-credentials: false - name: JSON validity run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty - name: YAML validity diff --git a/.mcp.json b/.mcp.json index e16128b..7a030cd 100644 --- a/.mcp.json +++ b/.mcp.json @@ -2,7 +2,16 @@ "mcpServers": { "serena": { "command": "uvx", - "args": ["serena", "start-mcp-server", "--context", "claude-code", "--project", "."] + "args": [ + "--from", + "git+https://github.com/oraios/serena@43ae0211d7f3bba4101cd0552707fa21d37f4c84", + "serena", + "start-mcp-server", + "--context", + "claude-code", + "--project", + "." + ] } } } From 3c803607e518ff8fdcca19ee71b011fc75da1e48 Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 19:09:39 -0400 Subject: [PATCH 2/5] repo: run the term wall in CI Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230938Z-apply-push-37f496 Patch-SHA256: b4531359ae7de13e8c3971798360d09faad4bb1369d9460ef9d09472c51e51e7 --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 457b587..0893ae0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,6 +12,10 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: persist-credentials: false + - name: term wall + uses: minspec/.github/.github/actions/term-wall@6175b67bd0df4710dd0bb8b79df413b452265c6c # minspec/.github#8 + env: + TERM_WALL: ${{ vars.TERM_WALL }} - name: JSON validity run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty - name: YAML validity From 4bedba136eb9edb0f6eb4b72c5590c79ba5be78c Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 19:47:00 -0400 Subject: [PATCH 3/5] repo: scan a pull request again when its text is edited `pull_request` without `types` fires on opened, synchronize and reopened only, so a title or body edited after the checks passed reached the merge unscanned. Name the types and add `edited`; the wall then runs against the current text. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T234700Z-apply-push-f50b1d Patch-SHA256: 2a0805c0fffd8c391d021298a54e94a005628bc080ab5fa7f622a67ff5137d9c --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0893ae0..9e3ea2c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,7 @@ name: ci on: pull_request: + types: [opened, synchronize, reopened, edited] push: branches: [dev, main] permissions: From 255277b1fda5bddb17a8f92b28cfb7d522e0229e Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Tue, 1 Sep 2026 20:40:53 -0400 Subject: [PATCH 4/5] repo: move the wall to the object-store scan minspec/.github#10 pins the content surface to every tracked blob, read from the object store, bytewise, symlinks never followed. Point the wall step at that merge. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260902T004053Z-apply-push-b507a7 Patch-SHA256: 6e2ac3b46cc179bb7757c9e87d797f7304beb2346b944b3db8dadb6829f53c2f --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9e3ea2c..f30f726 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,7 @@ jobs: with: persist-credentials: false - name: term wall - uses: minspec/.github/.github/actions/term-wall@6175b67bd0df4710dd0bb8b79df413b452265c6c # minspec/.github#8 + uses: minspec/.github/.github/actions/term-wall@a5d88bb5b9bb744cf23c8829436e32f03d58c79d # minspec/.github#10 env: TERM_WALL: ${{ vars.TERM_WALL }} - name: JSON validity From 55a5d7bf69f31b73a4b48340d8d34db8381d18c6 Mon Sep 17 00:00:00 2001 From: Apply Push Bridge Date: Wed, 2 Sep 2026 18:26:49 -0400 Subject: [PATCH 5/5] repo: master is the release branch Workflows name master where they named main, and CODEOWNERS makes the release branch the owner's to approve. Source: original Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260902T222649Z-apply-push-6a0f71 Patch-SHA256: 7dd99a9140904ef4c750a03228fe34172bb28ee74d20c374ef642cb9557ee5b2 --- .github/CODEOWNERS | 1 + .github/workflows/ci.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..1efe9b8 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @xormania diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f30f726..51e8847 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,7 +3,7 @@ on: pull_request: types: [opened, synchronize, reopened, edited] push: - branches: [dev, main] + branches: [dev, master] permissions: contents: read jobs: