Skip to content

Commit eeb10dc

Browse files
vincentkocvincentkoc
authored
Merge pull request #57 from openclaw/ci-security-baseline
chore(ci): add crawl security baseline
2 parents 016e849 + 0da02de commit eeb10dc

6 files changed

Lines changed: 216 additions & 0 deletions

File tree

‎.editorconfig‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
insert_final_newline = true
7+
indent_style = tab
8+
indent_size = 4
9+
10+
[*.{md,yml,yaml,json,toml}]
11+
indent_style = space
12+
indent_size = 2

‎.gitattributes‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
* text=auto
2+
*.go text eol=lf
3+
*.md text eol=lf
4+
*.toml text eol=lf
5+
*.yml text eol=lf
6+
*.yaml text eol=lf

‎.github/CODEOWNERS‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Protect ownership and automation rules.
2+
/.github/CODEOWNERS @openclaw/openclaw-secops
3+
/.github/dependabot.yml @openclaw/openclaw-secops
4+
/.github/workflows/ @openclaw/openclaw-secops
5+
6+
# Release, backup, and package integrity surfaces.
7+
/.goreleaser.yaml @openclaw/openclaw-secops
8+
/go.mod @openclaw/openclaw-secops
9+
/go.sum @openclaw/openclaw-secops
10+
/scripts/*backup* @openclaw/openclaw-secops
11+
/scripts/*release* @openclaw/openclaw-secops
12+
/scripts/*publish* @openclaw/openclaw-secops

‎.github/workflows/codeql.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: CodeQL
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches:
7+
- main
8+
schedule:
9+
- cron: "29 4 * * 1"
10+
workflow_dispatch:
11+
12+
permissions:
13+
actions: read
14+
contents: read
15+
security-events: write
16+
17+
jobs:
18+
analyze:
19+
name: analyze
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@v6
24+
25+
- name: Setup Go
26+
uses: actions/setup-go@v6
27+
with:
28+
go-version-file: go.mod
29+
cache: true
30+
31+
- name: Initialize CodeQL
32+
uses: github/codeql-action/init@v4
33+
with:
34+
languages: go
35+
36+
- name: Perform CodeQL Analysis
37+
uses: github/codeql-action/analyze@v4

‎.github/workflows/secret-scan.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: "Security Gate: Secret Scanning"
2+
3+
on:
4+
push:
5+
branches: ["**"]
6+
pull_request:
7+
branches: [main, master]
8+
9+
permissions: {}
10+
11+
jobs:
12+
trufflehog:
13+
name: Scan for Verified Secrets
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v6
20+
with:
21+
fetch-depth: 0
22+
23+
- name: Resolve scan range
24+
id: scan_range
25+
env:
26+
EVENT_NAME: ${{ github.event_name }}
27+
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
28+
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
29+
PUSH_BASE_SHA: ${{ github.event.before }}
30+
PUSH_HEAD_SHA: ${{ github.sha }}
31+
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
32+
run: |
33+
set -euo pipefail
34+
zero_sha="0000000000000000000000000000000000000000"
35+
36+
if [[ "$EVENT_NAME" == "pull_request" ]]; then
37+
base="$PR_BASE_SHA"
38+
head="$PR_HEAD_SHA"
39+
else
40+
base="$PUSH_BASE_SHA"
41+
head="$PUSH_HEAD_SHA"
42+
if [[ -z "$base" || "$base" == "$zero_sha" ]]; then
43+
base="origin/$DEFAULT_BRANCH"
44+
fi
45+
fi
46+
47+
echo "base=$base" >> "$GITHUB_OUTPUT"
48+
echo "head=$head" >> "$GITHUB_OUTPUT"
49+
50+
- name: TruffleHog OSS
51+
id: trufflehog
52+
uses: trufflesecurity/trufflehog@v3.95.2
53+
with:
54+
path: ./
55+
base: ${{ steps.scan_range.outputs.base }}
56+
head: ${{ steps.scan_range.outputs.head }}
57+
extra_args: --only-verified --debug
58+
59+
- name: Notify on failure
60+
if: steps.trufflehog.outcome == 'failure'
61+
run: |
62+
echo "::error::Verified secrets found. Rotate the credential before merging."
63+
exit 1

‎.github/workflows/stale.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: Stale
2+
3+
on:
4+
schedule:
5+
- cron: "25 4 * * *"
6+
workflow_dispatch:
7+
8+
permissions: {}
9+
10+
jobs:
11+
stale:
12+
permissions:
13+
issues: write
14+
pull-requests: write
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Mark stale unassigned issues and pull requests
18+
uses: actions/stale@v10
19+
with:
20+
days-before-issue-stale: 14
21+
days-before-issue-close: 7
22+
days-before-pr-stale: 14
23+
days-before-pr-close: 7
24+
stale-issue-label: stale
25+
stale-pr-label: stale
26+
exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale
27+
exempt-pr-labels: maintainer,no-stale
28+
operations-per-run: 1000
29+
ascending: true
30+
exempt-all-assignees: true
31+
remove-stale-when-updated: true
32+
stale-issue-message: |
33+
This issue has been automatically marked as stale due to inactivity.
34+
Please add updated discrawl details or it will be closed.
35+
stale-pr-message: |
36+
This pull request has been automatically marked as stale due to inactivity.
37+
Please update it or it will be closed.
38+
close-issue-message: |
39+
Closing due to inactivity.
40+
If this still affects discrawl, open a new issue with current reproduction details.
41+
close-issue-reason: not_planned
42+
close-pr-message: |
43+
Closing due to inactivity.
44+
If this PR should be revived, reopen it with current context and validation.
45+
46+
- name: Mark stale assigned issues
47+
uses: actions/stale@v10
48+
with:
49+
days-before-issue-stale: 30
50+
days-before-issue-close: 10
51+
days-before-pr-stale: -1
52+
days-before-pr-close: -1
53+
stale-issue-label: stale
54+
exempt-issue-labels: enhancement,maintainer,pinned,security,no-stale
55+
operations-per-run: 1000
56+
ascending: true
57+
include-only-assigned: true
58+
remove-stale-when-updated: true
59+
stale-issue-message: |
60+
This assigned issue has been automatically marked as stale after 30 days of inactivity.
61+
Please add an update or it will be closed.
62+
close-issue-message: |
63+
Closing due to inactivity.
64+
If this still affects discrawl, reopen or file a new issue with current evidence.
65+
close-issue-reason: not_planned
66+
67+
- name: Mark stale assigned pull requests
68+
uses: actions/stale@v10
69+
with:
70+
days-before-issue-stale: -1
71+
days-before-issue-close: -1
72+
days-before-pr-stale: 27
73+
days-before-pr-close: 7
74+
stale-pr-label: stale
75+
exempt-pr-labels: maintainer,no-stale
76+
operations-per-run: 1000
77+
ascending: true
78+
include-only-assigned: true
79+
ignore-pr-updates: true
80+
remove-stale-when-updated: true
81+
stale-pr-message: |
82+
This assigned pull request has been automatically marked as stale after being open for 27 days.
83+
Please add an update or it will be closed.
84+
close-pr-message: |
85+
Closing due to inactivity.
86+
If this PR should be revived, reopen it with current context and validation.

0 commit comments

Comments
 (0)