.github security

Author: pcarrier

.github/workflows/go-presubmit.yml

@@ -7,6 +7,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Go presubmit
@@ -16,10 +19,29 @@ jobs:
         go-version: ['1.22']
     steps:
     - name: Install Go ${{ matrix.go-version }}
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
       with:
         go-version: ${{ matrix.go-version }}
-    - uses: actions/checkout@v3
-    - uses: creachadair/go-presubmit-action@v2
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+    - name: Security scan for dangerous Go patterns
+      run: |
+        # Detect go:generate directives (potential code execution)
+        if grep -rn '//go:generate' --include='*.go' .; then
+          echo "::error::Detected //go:generate directive - requires manual review"
+          exit 1
+        fi
+        # Detect CGo usage (native code execution during build)
+        if grep -rn 'import "C"' --include='*.go' .; then
+          echo "::error::Detected CGo import - requires manual review"
+          exit 1
+        fi
+        # Detect #cgo directives
+        if grep -rn '#cgo' --include='*.go' .; then
+          echo "::error::Detected #cgo directive - requires manual review"
+          exit 1
+        fi
+
+    - uses: creachadair/go-presubmit-action@4f7a734aa8275675a945fbf589734f8cf7dda58a # v2.0.3
       with:
         staticcheck-version: "2023.1.6"

.github/workflows/goreleaser.yml

@@ -5,41 +5,63 @@ on:
     branches:
       - main
     tags:
-      - '*'
+      - 'v[0-9]+.[0-9]+.[0-9]+*'  # Only semver tags (v1.2.3, v1.2.3-rc1, etc.)
   pull_request:
     types: [opened, reopened, synchronize]
 
-permissions:
-  contents: write
-
 jobs:
-  goreleaser:
+  # PR and main branch: only build validation, NO goreleaser (prevents hook injection)
+  validate:
+    if: github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/'))
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version: 1.22
 
-      - name: Run GoReleaser release (SKIP publish)
-        uses: goreleaser/goreleaser-action@v5
-        if: startsWith(github.ref, 'refs/tags/') != true
+      - name: Security scan for dangerous Go patterns
+        run: |
+          if grep -rn '//go:generate\|import "C"\|#cgo' --include='*.go' .; then
+            echo "::error::Detected potentially dangerous Go directive"
+            exit 1
+          fi
+
+      - name: Build
+        run: go build -v ./...
+
+      - name: Test
+        run: go test -v ./...
+
+  # Release: only on semver tags, with environment protection
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          distribution: goreleaser
-          version: latest
-          args: release --clean --skip=publish --snapshot
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: 1.22
 
-      - name: Run GoReleaser release
-        uses: goreleaser/goreleaser-action@v5
-        if: startsWith(github.ref, 'refs/tags/')
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
         with:
           distribution: goreleaser
-          version: latest
+          version: "2.6.1"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GH_PAT }}

protocol/transfer.go

@@ -154,8 +154,8 @@ type ListTeamsRequest struct {
 }
 
 type Team struct {
-	ID     string `cbor:"1,keyasint,omitempty"`
-	Name   string `cbor:"2,keyasint,omitempty"`
+	ID   string `cbor:"1,keyasint,omitempty"`
+	Name string `cbor:"2,keyasint,omitempty"`
 }
 
 type ListTeamsResponse struct {
@@ -577,8 +577,8 @@ type ParallelDownloader struct {
 	clients   []*http.Client
 	baseURL   string
 	encMode   cbor.EncMode
-	sem       chan struct{}  // semaphore for concurrent downloads
-	clientIdx atomic.Uint64  // round-robin index for client selection
+	sem       chan struct{} // semaphore for concurrent downloads
+	clientIdx atomic.Uint64 // round-robin index for client selection
 }
 
 // NewParallelDownloader creates a downloader that spreads requests across IPs