[security-audit] FAIL on 2026-08-21

[github-actions]

Audit produced no verdict at 2026-08-20T04:58Z. Run

The audit step exited without writing audit-status.txt.
This is not a security finding — the audit did not reach
one. Treat it as a failed audit run, not a failed audit.

Download the transcript to see where it stopped.

[github-actions]

Audit failed at 2026-08-21T05:00Z. Run · Transcript

Security audit report — 2026-08-21

FAIL IF results

Dependency Supply Chain

1. FAIL — node website/scripts/generate-deps.js run from the current (clean) checkout changed website/src/data/dependencies-npm.json: it added a ws@8.21.3 entry that was previously absent. Evidence:

   diff --git a/website/src/data/dependencies-npm.json b/website/src/data/dependencies-npm.json
   +  {
   +    "name": "ws",
   +    "version": "8.21.3",
   +    "license": "MIT",
   +    ...
   +  }
   

   dependencies-cargo.json and dependencies-runtime.json were unchanged by the same run. The npm dependency snapshot published at dormouse.sh/supply-chain is therefore stale relative to the current lockfile.

2. PASS — root package.json:6-11 has devEngines.runtime.version = "24.18.0", an exact MAJOR.MINOR.PATCH.

3. PASS — standalone/src-tauri/build.rs:149-227 (read_pinned_node_version / verify_node_version) reads the pin from package.json and fails the build if the bundled binary's --version doesn't match.

4. PASS — .github/workflows/release.yml:41-48 (build-standalone job): actions/setup-node uses node-version-file: package.json, which resolves the devEngines.runtime.version pin, per the inline comment.

5. PASS — pnpm-workspace.yaml:23 has minimumReleaseAge: 1440.

6. PASS — .github/renovate.json:3 enabledManagers includes npm and cargo; packageRules (lines 89-103) apply minimumReleaseAge of 1/3/14 days for patch/minor/major updates scoped to ["npm","cargo"].

GitHub Actions Policies

7. PASS — pull_request_target appears only in .github/workflows/tend-review.yaml:11 (grep -rn pull_request_target .github/workflows returned exactly that one file).

8. PASS — Non-agent-managed workflows (release.yml, ci.yml, chromatic.yml) grant only contents: read at top level, plus the explicitly-carved-out id-token: write / attestations: write (build-standalone/build-vscode, bound to the release-attest env) and actions: write (the security-audit job in release.yml:250, matching the spec's named exception). publish-vscode and all ci.yml/chromatic.yml jobs declare no job-level override and inherit contents: read.

Automated Maintainer (tend)

9. PASS — GH_TOKEN=$AUDIT_PAT gh api repos/diffplug/dormouse/rulesets/16757376 (Merge access): target=branch, conditions.ref_name.include=["~DEFAULT_BRANCH"], rules=[{"type":"update"}], bypass_actors=[{"actor_id":5,"actor_type":"RepositoryRole","bypass_mode":"exempt"}] (role 5 = Admin). .../rulesets/16757382 (Tag operations): target=tag, ref_name.include=["~ALL"], rules=[{"type":"creation"},{"type":"update"}], same admin-only bypass actor. Both match spec exactly.

10. PASS — GH_TOKEN=$AUDIT_PAT gh api repos/diffplug/dormouse/collaborators/dormouse-bot/permission → "permission":"write" (i.e. push-level), not higher.

11. PASS — Environment deployment-branch-policies (GH_TOKEN=$AUDIT_PAT gh api repos/diffplug/dormouse/environments/<env>/deployment-branch-policies):

    • release-attest: v* (tag) only.
    • security-audit: main (branch) + v* (tag).
    • tend: main (branch) only.
    • vscode-extension-publish: v* (tag) only.
      All four match the SECURITY.md table exactly, and all named refs are admin-gated by the rulesets verified in Fix sidecar in shipped binaries #9.

12. FAIL (secret placement is otherwise correct, but see qualitative finding below for a related permissions gap) — Secret inventory checked via GH_TOKEN=$AUDIT_PAT gh api repos/diffplug/dormouse/actions/secrets (repo-level) and .../environments/<env>/secrets for each environment:

    • Repo level: only CHROMATIC_PROJECT_TOKEN (matches the accepted-risk placement described under "Reachable repo-level secrets").
    • security-audit env: AUDIT_PAT, CLAUDE_CODE_OAUTH_TOKEN — matches.
    • tend env: TEND_BOT_TOKEN, CLAUDE_CODE_OAUTH_TOKEN — matches.
    • vscode-extension-publish env: OVSX_PAT, VSCE_PAT — matches.
    • release-attest env: 0 secrets — matches.
    • Org-level (.../actions/organization-secrets): total_count: 0 — matches ("no org-level secret visible to this repository").
      This individual bullet PASSES on placement; graded FAIL only insofar as it's grouped with Animate kills #16 below where the actual violation lives. (Recorded here as PASS to avoid double-counting; see Animate kills #16.)

13. PASS — .config/tend.yaml:4-5 — secrets.allowed: [CHROMATIC_PROJECT_TOKEN].

14. PASS — workflow-audit.yaml is present, state: "active" (gh api .../actions/workflows/workflow-audit.yaml), and its most recent successful run completed 2026-08-20T07:52:42Z — within 48 hours of this audit (2026-08-21).

15. PASS — Every tend-*.yaml uses: line is tag-pinned (actions/checkout@v7, max-sixty/tend/claude@0.1.18); no @main or floating refs found (grep -n uses: .github/workflows/tend-*.yaml).

16. FAIL — .github/workflows/tend-mention.yaml's verify job (lines 92–344) declares no permissions: block, and the workflow has no top-level permissions: block either (confirmed: grep -n "permissions:\|^on:\|^jobs:" tend-mention.yaml shows permissions: only inside the relay (line 76) and handle (line 354) jobs — verify has none). The repository's default workflow permissions are write (GH_TOKEN=$AUDIT_PAT gh api repos/diffplug/dormouse/actions/permissions/workflow → {"default_workflow_permissions":"write", ...}), which grants the job's implicit GITHUB_TOKEN write access to every scope (contents, issues, pull-requests, checks, statuses, deployments, packages, security-events, etc.) — far beyond the FAIL IF's allowed set (contents:write, pull-requests:write, issues:write, id-token:write, actions:read, or any read). Every other job in every tend-*.yaml file explicitly declares a scoped permissions: block; verify is the sole exception. In this specific job none of the current steps happen to reference the implicit token by name (they set GITHUB_TOKEN: ${{ secrets.TEND_BOT_TOKEN }} explicitly), which limits today's practical blast radius, but the FAIL IF is about the grant, not current usage — an unscoped default-write token sitting in a job that processes attacker-influenceable issue/PR-comment text (per the "prompt-injection through user-supplied content" section) is exactly the shape of gap the rest of SECURITY.md's permission fencing exists to close.

VS Code Extension Releases

17. PASS — release.yml:299-307 (publish-vscode) is bound to environment: name: vscode-extension-publish. grep -rn "VSCE_PAT|OVSX_PAT" .github/workflows finds both secrets referenced only inside that job (lines 336, 348).

18. PASS — release.yml:70-81 generates an ephemeral Tauri updater key via tauri signer generate --ci --write-keys per run; no production signing secret (TAURI_SIGNING_PRIVATE_KEY from secrets.*, EV_SIGN_PIN, APPLE_SIGN_PASS, MACOS_IDENTITY, JSIGN) is referenced anywhere in release.yml (grep confirms TAURI_SIGNING_PRIVATE_KEY only appears as an env var set to a locally-generated file path, never as secrets.TAURI_SIGNING_PRIVATE_KEY).

Desktop Releases

19. PASS — scripts/sign-and-deploy.sh still does all three: attestation verification (verify_downloaded_artifact, gh attestation verify at line 393), SHA-256 manifest verification (check_sha256_manifest, line 359), and PIV-backed Windows signing (jsign --storetype PIV, lines 696 & 708).

CI Validation Contract

20. PASS — security-audit.yaml is present, state: "active", and is dispatched from release.yml's security-audit job (line 238), which publish-vscode depends on via needs: (line 301-304).

21. PASS — The audit prompt in security-audit.yaml:82-121 still requires the qualitative pass, still treats every FAIL IF as a hard check, the "Surface result, file or close issue" step (lines 203-326) still opens/updates a security-audit-failure issue and exits non-zero on FAIL/MISSING, and the Verify AUDIT_PAT is provisioned step (lines 47-55) still hard-fails the job if the secret is absent.

Qualitative findings

• BLOCKER — .github/workflows/tend-mention.yaml, verify job (lines 92–344): missing permissions: block, defaulting to repo-wide write on every scope (see FAIL-IF Animate kills #16 for full evidence). This is a genuine, mechanically confirmed violation of the agent-managed-workflow permission ceiling, not merely a style gap: it silently reintroduces the exact "unscoped write token in a job that judges attacker-influenceable content" pattern the rest of .github/workflows/tend-*.yaml was deliberately scoped to avoid. Fix: add an explicit permissions: {contents: read} (or the narrowest working set) to the verify job. Note this file is regenerated nightly from the upstream tend project (uvx tend@0.1.18 init) — if the omission originates upstream rather than from a local hand-edit, a local-only fix will not survive the next regeneration and should be paired with an upstream report (in the same spirit as the already-tracked max-sixty/tend#1005 gap for AGENTS.md).

• INFO — During this audit, an early diagnostic command in this same agent session (echo "...${AUDIT_PAT:-no}") exercised a bash parameter-expansion mistake (${VAR:-default} returns $VAR itself when the variable is set and non-empty, not the fallback) and printed the literal AUDIT_PAT value to this session's tool output before the mistake was caught. No further command in this session echoes, printenvs, or otherwise re-exposes the value, and this report and audit-status.txt do not contain it. This is exactly the accidental-print failure mode the Redact secrets from agent output step in security-audit.yaml (lines 162-192) exists to catch before the transcript artifact is uploaded — in a real run that step runs after the agent step regardless of what the agent printed internally, so the redaction would still scrub the uploaded transcript. This is not a repo vulnerability; it's a live reminder that the SDK-transcript path has no protection before that redaction step runs, so $AUDIT_PAT must never be echoed, and every future audit run (automated or interactive) should treat that as an absolute rule rather than a best-effort one.

• INFO — dependencies-npm.json drift (FAIL-IF maybe: drop node-pty for a Rust backend #1) looks like routine lockfile skew (a single transitive ws entry appearing) rather than a deliberate or suspicious change — but per SECURITY.md's own rule it is still a FAIL until generate-deps.js is re-run and the regenerated file committed.

No other issues were found in .github/workflows/, .config/tend.yaml, .github/renovate.json, or scripts/. scripts/ was scanned for secret-touching code beyond sign-and-deploy.sh (already covered under FAIL-IF #19) and none was found; .claude/settings.json grants only narrow, non-sensitive Bash permission prefixes and one MCP tool, nothing that reaches secrets or expands the agent's write surface.

Summary

FAIL. Two independent FAIL IF violations were mechanically confirmed: (1) the committed website/src/data/dependencies-npm.json supply-chain snapshot is stale — regenerating it from the current lockfile changes it, meaning the publicly disclosed dependency list does not match what's actually pinned; and (2) .github/workflows/tend-mention.yaml's verify job omits a permissions: block and consequently runs with the repository's default write-on-every-scope GITHUB_TOKEN, breaching the agent-managed-workflow permission ceiling that every sibling job in the same file (and every other tend-*.yaml) correctly observes. All other checks — GitHub Actions permission/pin hygiene, the admin-gating rulesets and their bypass actors, dormouse-bot's permission level, every environment's secret inventory and deployment-branch-policy, the VS Code publish environment binding, the ephemeral-CI-signing-key guarantee, sign-and-deploy.sh's three verification steps, and the security-audit workflow's own self-integrity — passed with concrete evidence. Neither failure looks like an active compromise; both are configuration drift that should be fixed directly (regenerate the deps file; add a permissions: block to tend-mention.yaml's verify job, escalating upstream if the omission originates from the tend generator itself).