chore: org hardening — SHA-pinned actions, SLSA provenance, CODEOWNERS, SECURITY, CONTRIBUTING - #78
Merged
Merged
Conversation
Floating tags (actions/checkout@v7, softprops/action-gh-release@v3, ...) are mutable: whoever controls the upstream tag controls what runs with our GITHUB_TOKEN. Pinning to the 40-hex commit the current tag resolves to makes the workflow reproducible and immune to tag hijacking; the trailing "# vN.M.P" comment keeps the version human-readable and lets Dependabot's github-actions ecosystem keep both the SHA and the comment current. Resolved on 2026-09-06 via the GitHub refs API (annotated tags dereferenced to their commit): actions/checkout@v7 -> 3d3c42e5 (v7.0.1) actions/setup-go@v7 -> b7ad1dad (v7.0.0) golangci/golangci-lint-action@v9 -> ba0d7d2e (v9.3.0) softprops/action-gh-release@v3 -> efb35369 (v3.0.3) No behavior change: each SHA is exactly the commit the floating tag pointed at. Org hardening review 2026-09-06.
actions/checkout writes the job's GITHUB_TOKEN into .git/config (persist-credentials: true by default). Every subsequent step — and any tool they run, e.g. `go install ...@latest`, golangci-lint, the integration testserver — can read it back. None of the CI jobs (lint, test, integration) nor the release "publish" job push, tag or write to the repository, so they get `persist-credentials: false`. The release "binaries" job is left at the default: it hands a release-writing step (softprops/action-gh-release) the token, and the review rule is to leave the default wherever a step pushes, tags or writes releases. No behavior change for the workflows' own steps. Org hardening review 2026-09-06.
Bench orchestrators (probatorium) fetch loadgen tarballs straight from GitHub Releases and run them on the load hosts. Until now the only integrity signal was the SHA-256 GitHub displays next to the asset, which proves the download matched what was uploaded — not that it was built by this repository's workflow from a given commit. The "binaries" job now runs actions/attest-build-provenance (pinned to 4d101475, v4.2.2) on the exact archive it is about to upload, BEFORE the softprops/action-gh-release step, so the attestation covers the bytes that ship. The job gets the minimum permission set the attestation needs: contents: write (upload, unchanged), id-token: write (OIDC identity that Sigstore signs the SLSA predicate with) and attestations: write (store it in the repo's attestation store). The upload step itself is unchanged. README gains a "Verify a release" section: gh attestation verify <asset> -R goceleris/loadgen and notes that releases before this change (<= v1.4.13) carry no attestation. Org hardening review 2026-09-06.
Makes review ownership explicit and machine-enforceable: GitHub auto-requests @FumingPower3925 on every pull request, and the "Require review from Code Owners" branch-protection option (configured separately) can turn that into a hard merge gate. The header explains the precedence rule and a commented example shows how to delegate a subsystem to a second maintainer when the time comes. Org hardening review 2026-09-06.
loadgen had no security policy, so a researcher's only option was a public issue. The new policy prefers GitHub private vulnerability reporting (Security tab -> "Report a vulnerability", enabled on the repository) with security@goceleris.dev as the fallback, commits to an acknowledgement within 72 hours, states that only the latest release is supported, scopes what counts as a loadgen vulnerability (response parsers, TLS handling, federation protocol, result output, release pipeline) and points engine issues at celeris/SECURITY.md. Org hardening review 2026-09-06.
Documents what CI actually runs (go build/vet, golangci-lint v2.13, the -race unit suite, the live-celeris integration matrix) so contributors can reproduce a green run locally, the branch/commit conventions shared with celeris, and the merge rule — protected main, PR + CI + code-owner approval, maintainer merge — by reference to celeris/GOVERNANCE.md so the org has one governance source of truth. The PR template (Summary, Changes, Test Plan, Closes #) mirrors celeris' and adds the loadgen specific reminder that JSON-schema or flag changes must update the README contract that probatorium parses. Org hardening review 2026-09-06.
Auto-generated release notes were uncategorised. Adopt the same categories as celeris (Breaking Changes, Security, Fixes, Performance, Features, Other) so release pages across the org read alike, and exclude the dependencies / github_actions labels because Dependabot bumps are noise for people downloading the binaries. Org hardening review 2026-09-06.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
File-based hardening for
goceleris/loadgenfollowing the org hardening review 2026-09-06 (read-only audit of the goceleris org against mature open-source configuration). Workflow semantics are unchanged except where listed. Repository settings, rulesets and the bench cluster are handled separately and are not touched here.Changes
ci.ymlandrelease.yml(actions/checkout→3d3c42e5v7.0.1,actions/setup-go→b7ad1dadv7.0.0,golangci/golangci-lint-action→ba0d7d2ev9.3.0,softprops/action-gh-release→efb35369v3.0.3), with a# vN.M.PcommentGITHUB_TOKEN. Each SHA is exactly the commit the current tag resolves to (annotated tags dereferenced via the GitHub refs API), so there is no behaviour change. Dependabot's existinggithub-actionsecosystem keeps SHA + comment current.persist-credentials: falseonactions/checkoutin the CIlint,test,integrationjobs and the releasepublishjob.git/configwherego install …@latest, golangci-lint and the integration testserver could read it. The releasebinariesjob keeps the default because it feeds a release-writing step.release.yml: thebinariesjob getspermissions: {contents: write, id-token: write, attestations: write}and a newactions/attest-build-provenance@4d101475 # v4.2.2step whosesubject-pathis the tarball, placed before the (kept)softprops/action-gh-releaseuploadgh attestation verify <asset> -R goceleris/loadgen.github/CODEOWNERS— header comment,* @FumingPower3925, commented area-delegation exampleSECURITY.md— private reporting via the Security tab → "Report a vulnerability" (preferred) or security@goceleris.dev, 72-hour acknowledgement, supported versions (latest release), scope, pointer toceleris/SECURITY.mdfor the engineCONTRIBUTING.md— Go build/test/lint commands as CI runs them, PR flow, commit conventions, merge rule by reference toceleris/GOVERNANCE.md.github/PULL_REQUEST_TEMPLATE.md— Summary, Changes, Test Plan,Closes #.github/release.yml— categories Breaking Changes / Security / Fixes / Performance / Features / Other; excludesdependencies,github_actionslabelsTest Plan
actionlintclean on both workflowspython3 -c 'import yaml'parsesci.yml,release.yml,.github/release.yml,dependabot.ymlgrep -E 'uses: [^./][^@]*@v' .github/workflows/*.ymlfinds nothing (no unpinned action left)go build ./... && go vet ./...(no Go source changed; sanity)releases/latesttag of each action (floating major and exact release tag point at the same commit)gh attestation verify loadgen_linux_amd64.tar.gz -R goceleris/loadgenFollow-ups outside this PR (settings, not files)
mainruleset so CODEOWNERS becomes a merge gate.celeris/GOVERNANCE.md(linked from CONTRIBUTING.md) is being added in the celeris hardening PR.