From d69f6c22c024a8132f22ee93dc437be46c595eaa Mon Sep 17 00:00:00 2001
From: xormania <127287135+xormania@users.noreply.github.com>
Date: Tue, 1 Sep 2026 13:43:37 -0400
Subject: [PATCH] repo: workflow and MCP hardening from the security audit

Findings applied from the independent audit (CHANGES verdict):
workflow-level permissions contents:read; persist-credentials false
on checkout; every action pinned to a reviewed commit SHA with its
tag in a comment; Serena pinned in .mcp.json to the audited git
commit instead of floating uvx resolution.

Finding: [P1] workflows ran with default token permissions
Finding: [P1] .mcp.json launched unversioned uvx serena
Finding: [P2] mutable action tags across all repositories
Verified: python yaml.safe_load + json.load on the changed files

Source: original
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reviewed-by: GPT-5 Codex <noreply@openai.com>
Claude-Session: https://claude.ai/code/session_01XehTac5TJNmPAskwrPp7rJ
---
 .github/workflows/ci.yml |  6 +++++-
 .mcp.json                | 11 ++++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ee7ec5..b05d4a6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,11 +3,15 @@ on:
   pull_request:
   push:
     branches: [dev, master]
+permissions:
+  contents: read
 jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - name: JSON validity
         run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty
       - name: YAML validity
diff --git a/.mcp.json b/.mcp.json
index e16128b..7a030cd 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -2,7 +2,16 @@
   "mcpServers": {
     "serena": {
       "command": "uvx",
-      "args": ["serena", "start-mcp-server", "--context", "claude-code", "--project", "."]
+      "args": [
+        "--from",
+        "git+https://github.com/oraios/serena@43ae0211d7f3bba4101cd0552707fa21d37f4c84",
+        "serena",
+        "start-mcp-server",
+        "--context",
+        "claude-code",
+        "--project",
+        "."
+      ]
     }
   }
 }