Lotus CIandClaude Opus 5.5
1dacf29d53
Lint / Shell (shellcheck) (push) Successful in 14s
Lint / JS (eslint) (push) Successful in 11s
Lint / No secrets in webhook configs (push) Successful in 7s
Lint / Python (ruff) (push) Successful in 13s
Lint / Python deps (pip-audit) (push) Successful in 1m46s
Lint / Secret scan (gitleaks) (push) Successful in 11s
deploy/hooks-lxc*.json in this public repo held the HMAC secrets for
every auto-deploy webhook (and 106's cinny-build token), readable
anonymously. Six values had been committed: the four matrix-deploy
secrets, 106's lotus-deploy secret (publicly reachable through
chat.lotusguild.org/hooks/lotus-deploy) and the cinny-build token.
- All six rotated on the servers and in Gitea (matrix hooks 6-9,
cinny hook 69). The old values are rejected.
- Secrets now live in /etc/webhook/secrets.env (0600) on each LXC, loaded
by a systemd drop-in that also enables webhook's -template mode; the
hooks files use {{ getenv "NAME" | js }} placeholders.
- The repo hooks files are now exact copies of the live ones, so they
also document the *-config-deploy hooks they were missing. Those
three secrets were never committed and are unchanged.
- README: where the secrets live and how to rotate one.
- CI `hooks-no-secrets` fails if a literal secret lands in a hooks
file again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA
112 lines
3.7 KiB
YAML
112 lines
3.7 KiB
YAML
name: Lint
|
|
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
branches: ["**"]
|
|
|
|
jobs:
|
|
shell-lint:
|
|
name: Shell (shellcheck)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install shellcheck
|
|
run: apt-get update -qq && apt-get install -y -qq shellcheck
|
|
|
|
- name: Run shellcheck
|
|
run: find . -name "*.sh" -exec shellcheck {} +
|
|
|
|
js-lint:
|
|
name: JS (eslint)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install ESLint
|
|
run: npm install --save-dev eslint@8
|
|
|
|
- name: Run ESLint
|
|
run: npx eslint --ext .js hookshot/
|
|
|
|
hooks-no-secrets:
|
|
name: No secrets in webhook configs
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
# deploy/hooks-*.json are public; their secrets come from
|
|
# /etc/webhook/secrets.env on each LXC via `{{ getenv "..." }}`.
|
|
- name: Reject literal secrets
|
|
run: |
|
|
if grep -nE '[0-9a-fA-F]{32,}' deploy/hooks-*.json; then
|
|
echo "::error::A literal secret/token is committed in deploy/hooks-*.json. Use {{ getenv \"NAME\" | js }} and put the value in /etc/webhook/secrets.env on the LXC."
|
|
exit 1
|
|
fi
|
|
|
|
python-lint:
|
|
name: Python (ruff)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install ruff
|
|
run: |
|
|
curl -sSL https://github.com/astral-sh/ruff/releases/download/0.8.6/ruff-x86_64-unknown-linux-gnu.tar.gz \
|
|
| tar -xz --strip-components=1
|
|
mv ruff /usr/local/bin/ruff
|
|
|
|
- name: Check syntax errors
|
|
run: ruff check matrixbot/ --select E9,F63,F7,F82 --output-format=github
|
|
|
|
- name: Run full lint
|
|
run: ruff check matrixbot/ --output-format=github
|
|
|
|
python-audit:
|
|
name: Python deps (pip-audit)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install Python 3.10 and pip-audit
|
|
run: |
|
|
# Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary
|
|
curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \
|
|
| tar -xz -C /opt
|
|
# Install bot deps + pip-audit into the same env; --local below avoids
|
|
# pip-audit creating an internal venv (ensurepip fails on standalone builds)
|
|
/opt/python/bin/pip install --upgrade pip setuptools
|
|
/opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt
|
|
|
|
- name: Audit matrixbot dependencies
|
|
# --local scans the env without spawning a venv (required for standalone Python)
|
|
# CVE-2026-3219 is in pip itself, not our code — ignore it explicitly
|
|
run: /opt/python/bin/pip-audit --local --ignore-vuln CVE-2026-3219
|
|
|
|
secret-scan:
|
|
name: Secret scan (gitleaks)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install gitleaks
|
|
run: |
|
|
curl -sSL --retry 3 --retry-delay 5 --max-time 120 \
|
|
https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
|
|
| tar -xz gitleaks
|
|
mv gitleaks /usr/local/bin/gitleaks
|
|
|
|
- name: Scan for secrets
|
|
run: |
|
|
# Scan application code directories — deploy/ is excluded because
|
|
# it contains intentional Gitea webhook HMAC secrets in hooks-lxc*.json
|
|
for dir in matrixbot/ hookshot/ .gitea/ systemd/ cinny/ landing/; do
|
|
[ -d "$dir" ] || continue
|
|
gitleaks detect --source "$dir" --no-git --config .gitleaks.toml \
|
|
--redact --exit-code 1
|
|
done
|