security: pin the gitleaks download with a SHA-256 checksum

[jeremy]

Pin the gitleaks download with a SHA-256 checksum

(Threat: T5 supply chain — an unpinned release download means a compromised or tampered gitleaks release asset executes in CI.)

• gitleaks pinning: the secret-scanning workflow now verifies the gitleaks release tarball against a pinned SHA-256 (from the release checksums.txt) before installing it:

  env:
    GITLEAKS_VERSION: 8.21.2
    GITLEAKS_SHA256: 5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba
  run: |
    curl -sSfL -o gitleaks.tar.gz "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
    echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
    tar -xzf gitleaks.tar.gz gitleaks

• gosec gate (unchanged, rationale documented): the standalone gosec scan stays advisory (-no-fail, with full SARIF upload to the Security tab). Its enforcing counterpart is golangci-lint (make lint), which honors the repo's per-site //nolint:gosec suppressions; the standalone binary can't read those, and globally excluding rule IDs (e.g. G101/G204) to make it hard-fail would blind release scans to new hard-coded creds / unsafe exec.

History

This PR originally also set toolchain go1.26.3 and bumped golang.org/x/net to v0.55.0 / golang.org/x/term to v0.43.0, taking govulncheck ./... from 6 reachable advisories to "No vulnerabilities found." Main has since independently moved to go 1.26.5 with those same dependency versions, so after rebasing onto current main the dependency changes are subsumed and only the gitleaks pin remains.

---

Part 6/6 of the stacked security series. Base: security/05-perms-and-exec-args.

📚 Stack (merge bottom-up)

1. security: reject foreign-host URLs in api to prevent token leak #478 — reject foreign-host URLs in api (base main)
2. security: strip ANSI/OSC escapes from API-controlled output #479 — strip ANSI/OSC escapes from output
3. security: harden OAuth discovery and token endpoints #480 — harden OAuth discovery / token endpoints
4. security: close config trust-boundary gaps and gate completion loader #481 — close config trust-boundary gaps + completion gate
5. security: tighten config-dir perms and validate plugin scope argv #482 — tighten config-dir perms + plugin scope argv
6. security: pin the gitleaks download with a SHA-256 checksum #483 — pin the gitleaks download with a SHA-256 checksum

Each is independent except #482 depends on #481 (shared root.go). #478 can land first/alone.

---

Summary by cubic

Pins and verifies the gitleaks v8.21.2 Linux tarball in CI using the release’s SHA-256 before extraction, preventing swapped or tampered downloads in the secret-scanning workflow. The gosec step remains advisory (-no-fail) with SARIF upload; enforcement continues via golangci-lint.

^{Written for commit 1af8f25. Summary will update on new commits.}

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/security.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: feaed83814

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR upgrades the Go toolchain/dependencies to address reported CVEs and strengthens the CI security workflow by making security scanners more tamper-resistant and stricter.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Changes:

• Add toolchain go1.26.3 and bump golang.org/x/net (and related indirect sums) to newer patched versions.
• Harden gitleaks installation in CI by verifying the downloaded release tarball against a pinned SHA-256.
• Tighten the standalone gosec CI job by removing -no-fail and excluding the existing accepted baseline rule set.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Pins the Go toolchain and bumps indirect x/net / x/term versions.
go.sum	Updates module checksums to match the bumped indirect dependencies.
.github/workflows/security.yml	Hardens gitleaks install via checksum verification and turns gosec into a failing gate.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 54c2ef1b25

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

[robzolkos]

We opened a small main-based PR with the minimal pieces needed to unblock main and the Nix install path: #508.

That PR intentionally limits scope to:

• updating nixpkgs so go_1_26 provides Go 1.26.4
• bumping golang.org/x/net / x/term to clear the current Trivy findings
• refreshing the Nix vendorHash

Leaving the broader CI hardening/gitleaks/gosec work here for separate review.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.