SonarCloud: GitHub Actions / dependency hardening

[don-petry]

SonarCloud: GitHub Actions / dependency hardening

13 open SonarCloud finding(s) in petry-projects/.github, worst severity MAJOR. Generated by the org SonarCloud Audit.

View in SonarCloud →

Findings

Rule	Count	Representative message
githubactions:S8541	5	Omitting "--only-binary :all:" can lead to the execution of setup scripts. Make sure it is
githubactions:S8544	3	Using dependencies without locking resolved versions is security-sensitive.
githubactions:S6505	2	"npx" can install packages on-demand and run their lifecycle scripts.
githubactions:S8545	2	Dependency versions are not predictable. Use a lock-file enforcing command instead.
githubactions:S8543	1	Define exact package version to avoid installing unverified releases.

Affected files

• .github/workflows/ci.yml (4)
• .github/workflows/dependency-audit-reusable.yml (2)
• .github/workflows/dependency-audit.yml (2)
• .github/workflows/feature-ideation-reusable.yml (2)
• .github/workflows/feature-ideation-tests.yml (2)
• .github/workflows/agent-shield-reusable.yml (1)

Priority

Labeled priority:major — mapped from this bucket's worst SonarCloud severity (MAJOR).

Acceptance

• All findings in this workstream resolved to zero in SonarCloud
• No behavior change; CI green
• Real fixes (no blanket NOSONAR unless a confirmed false positive, noted inline)

---

Idempotent issue — updated automatically each audit run; auto-closed when the finding count reaches zero.

[don-petry]

Dev-Lead: issue #623 implementation failed — will retry

The engine failed (engine-error — e.g. a timeout or transient engine error). This was attempt 1 of 3; dev-lead will retry automatically. You can also re-apply the dev-lead label to retry now.

• Cause: engine-error
• Run: https://github.com/petry-projects/.github/actions/runs/28892123958

[don-petry]

Dev-Lead Implementation Plan

Issue: #623 — SonarCloud: GitHub Actions / dependency hardening

Scope

Harden every unpinned pip install and npx invocation flagged across 6 workflows so dependency versions are locked and no lifecycle/setup scripts can run on-demand, resolving all 13 SonarCloud findings (S8541/S8543/S8544/S8545/S6505) with no behavior change.

Approach

• pip (S8541/S8543/S8544/S8545): follow the existing org pattern in scripts/copilot-requirements.txt — pin exact versions with SHA-256 hashes in a requirements file and install with pip install --require-hashes --only-binary :all: -r <file>.
• npx (S6505): replace npx <pkg>@<ver> with a version-pinned npm install -g <pkg>@<ver> --ignore-scripts followed by invoking the binary, matching the repo's existing --ignore-scripts hardening convention. No blanket NOSONAR.

Implementation Checklist

• Add scripts/ci-requirements.txt (yamllint, hash-pinned)
• Add scripts/dependency-audit-requirements.txt (pip-audit==2.9.0, hash-pinned)
• Add scripts/feature-ideation-requirements.txt (jsonschema, pyyaml, hash-pinned)
• ci.yml — pip install yamllint → requirements; npx AgentShield → pinned npm install --ignore-scripts
• dependency-audit.yml — pip-audit install → requirements
• dependency-audit-reusable.yml — pip-audit install → requirements (sparse-checkout the file from this repo)
• feature-ideation-reusable.yml — jsonschema install → requirements (from checked-out tooling)
• feature-ideation-tests.yml — jsonschema/pyyaml install → requirements
• agent-shield-reusable.yml — npx AgentShield → pinned npm install --ignore-scripts
• standards/agent-standards.md — update documented CLI reference to the hardened pattern

Tests

No behavior change (config/hardening only), so per the TDD exception this is validated by the repo's existing lint gates rather than new unit tests:

• yamllint (CI ruleset) on changed workflows
• actionlint on changed workflows
• bash .dev-lead/scripts/dev-lead-lint.sh

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh + actionlint .github/workflows/*.yml

[don-petry]

Dev-Lead: issue #623 implementation failed — will retry

The engine failed (engine-error — e.g. a timeout or transient engine error). This was attempt 2 of 3; dev-lead will retry automatically. You can also re-apply the dev-lead label to retry now.

• Cause: engine-error
• Run: https://github.com/petry-projects/.github/actions/runs/28951294927

[don-petry]

Dev-Lead: cannot implement issue #623 — needs human attention

Automatic retries are exhausted (attempt 3 of 3). The most recent failure was engine-error.

• Run: https://github.com/petry-projects/.github/actions/runs/28964018024

Last 40 lines of engine output (redacted)

    [copilot] calling gh copilot (model=openai/o4-mini, timeout=600s, flags=--yolo)
Error: Classic Personal Access Tokens (ghp_) are not supported by Copilot.

The GH_TOKEN environment variable contains a classic PAT.
Please use a Fine-Grained Personal Access Token or another authentication method.

To fix this, you can:
  • Replace the token in GH_TOKEN with a fine-grained PAT
  • Unset GH_TOKEN and run 'gh auth login' to authenticate
  • Unset GH_TOKEN and start 'copilot', then use the '/login' command

Please review the failures above. To retry anyway, remove the dev-lead:needs-human label and re-apply the dev-lead label.