[Security hardening] Add automated security audit workflow by PascalThuet · Pull Request #2442 · github/spec-kit

PascalThuet · 2026-05-02T06:39:31Z

Summary

Add a dedicated Security Audit workflow for dependency and static-analysis checks.
Audit committed hashed requirements on push, pull request, and manual dispatch so ordinary CI stays deterministic.
Verify committed audit requirements are refreshed when dependency inputs change, while keeping live dependency resolution for the scheduled audit across the supported Python and OS matrix.
Run Bandit for high-severity findings with a scoped baseline for the accepted shell-step B602 finding.
Pin all repository GitHub Actions to full commit SHAs.
Harden extension, preset, integration, and workflow downloads with bounded reads, strict HTTPS redirects, optional sha256 verification, bounded ZIP extraction, and source-path traversal guards.

Security context

This creates a repeatable CI baseline for dependency advisories and high-severity static-analysis issues while preserving a scheduled live-resolution signal for newly published dependency problems. It also closes similar supply-chain and archive-handling gaps found during follow-up review.

Closes #2438

Validation

git diff --check
uvx ruff check on all changed Python surfaces and tests
uv run python -m pytest tests/test_download_security.py tests/test_extensions.py tests/test_presets.py tests/integrations/test_integration_catalog.py tests/test_security_workflow.py tests/test_upgrade.py -q
uv run python -m pytest -q
uv pip compile pyproject.toml --extra test --universal --generate-hashes --quiet --no-header --output-file , compared with .github/security-audit-requirements.txt
uvx --from pip-audit==2.10.0 pip-audit --disable-pip --require-hashes -r .github/security-audit-requirements.txt --progress-spinner off
uvx --from bandit==1.9.4 bandit -r src -lll --baseline .github/bandit-baseline.json

Copilot

Pull request overview

Adds a new GitHub Actions workflow to introduce automated security checks for the Python codebase, aiming to catch dependency advisories and high-severity static-analysis findings in CI alongside the existing test/lint workflows.

Changes:

Add .github/workflows/security.yml with a dedicated Security Audit workflow.
Run pip-audit on pushes to main, pull requests, a weekly cron, and manual dispatch.
Run Bandit against src/, temporarily skipping B602 pending the shell-step hardening tracked in #2440.

Show a summary per file

File	Description
`.github/workflows/security.yml`	New CI workflow that adds dependency-audit and static-analysis jobs for the Python project.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 5

mnriem

Please address Copilot feedback. If not applicable, please explain why

PascalThuet · 2026-05-05T16:46:52Z

Addressed the Copilot feedback in the latest push:

Dependency auditing now exports the locked runtime + test extra dependency set with uv export --extra test --frozen --no-emit-project, then audits the generated requirements file.
pip-audit and Bandit are pinned via uvx --from (pip-audit==2.10.0, bandit==1.9.4).
Removed the global Bandit --skip B602; the existing shell execution call sites now use targeted # nosec B602 suppressions with local context.
Added CONTRIBUTING.md security-check commands so contributors can reproduce the workflow locally.

Local validation:

uv export --quiet --extra test --frozen --format requirements.txt --no-emit-project --output-file /tmp/spec-kit-audit-requirements.txt
uvx --from pip-audit==2.10.0 pip-audit -r /tmp/spec-kit-audit-requirements.txt --progress-spinner off
uvx --from bandit==1.9.4 bandit -r src -lll
git diff --check

Results: pip-audit reported no known vulnerabilities, Bandit reported no issues, and git diff --check passed.

PascalThuet · 2026-05-05T16:49:40Z

Added automated regression coverage for the security workflow in tests/test_security_workflow.py.

The new tests statically verify that:

dependency auditing exports the locked runtime + test extra requirements before running pip-audit;
pip-audit and Bandit remain pinned via uvx --from;
Bandit does not use a global --skip B602;
CONTRIBUTING.md documents the same security commands.

Validation after this commit:

uv run python -m pytest tests/test_security_workflow.py -q
uv export --quiet --extra test --frozen --format requirements.txt --no-emit-project --output-file /tmp/spec-kit-audit-requirements.txt
uvx --from pip-audit==2.10.0 pip-audit -r /tmp/spec-kit-audit-requirements.txt --progress-spinner off
uvx --from bandit==1.9.4 bandit -r src -lll
git diff --check

All passed locally.

Copilot

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

src/specify_cli/init.py:414

This second # nosec B602 suppresses Bandit for the non-capturing branch as well, so neither path through run_command will ever raise B602 again. If the intent is only to defer the current finding until #2440, the skip needs to stay in the workflow/configuration layer rather than permanently muting this call site in source.

            # shell=True is only available to callers that opt in explicitly.
            subprocess.run(cmd, check=check_return, shell=shell)  # nosec B602

Files reviewed: 5/5 changed files
Comments generated: 5

mnriem · 2026-05-05T18:04:30Z

Please address Copilot feedback. If not applicable, please explain why. Note the shell step should indeed be ignored

mnriem

See comments above

PascalThuet · 2026-05-05T20:18:16Z

Addressed the follow-up review in e1e8051:

Removed --frozen from the dependency export because this repo intentionally does not commit uv.lock; the workflow and contributor docs now use the same clean-checkout-safe command.
Replaced source-level # nosec B602 suppressions with a CI-level Bandit baseline at .github/bandit-baseline.json.
Kept that baseline scoped to exactly one accepted finding: B602 in ShellStep, matching the maintainer note that the shell step should be ignored.
Hardened the generic run_command helper so shell=True is rejected instead of suppressed, which removes the similar non-shell-step B602 sink entirely.
Expanded tests/test_security_workflow.py to catch these regressions: no lockfile flags, pinned tools, no global --skip B602, one-entry Bandit baseline, no source # nosec B602, docs in sync, and run_command(shell=True) rejection.

Validation:

uv export --quiet --extra test --format requirements.txt --no-emit-project --output-file /tmp/spec-kit-audit-requirements.txt
uvx --from pip-audit==2.10.0 pip-audit -r /tmp/spec-kit-audit-requirements.txt --progress-spinner off
uvx --from bandit==1.9.4 bandit -r src -lll --baseline .github/bandit-baseline.json
uv run python -m pytest tests/test_security_workflow.py tests/test_workflows.py -q
uvx ruff check src/
git diff --check

I also verified the uv export command in a temporary clean directory without uv.lock; it succeeds before running the audit.

PascalThuet · 2026-05-05T20:27:09Z

One more small cleanup after re-review: pushed 6f1da27 to use uv pip compile pyproject.toml --extra test for the audit requirements instead of uv export.

Reason: it still audits the runtime + test extra dependency set, but it avoids both requiring and generating a project uv.lock, which makes the CI and CONTRIBUTING.md command cleaner for this repo.

Revalidated locally:

uv pip compile pyproject.toml --extra test --quiet --output-file /tmp/spec-kit-audit-requirements.txt
uvx --from pip-audit==2.10.0 pip-audit -r /tmp/spec-kit-audit-requirements.txt --progress-spinner off
uvx --from bandit==1.9.4 bandit -r src -lll --baseline .github/bandit-baseline.json
uv run python -m pytest tests/test_security_workflow.py -q
git diff --check

All passed.

Copilot

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

tests/test_security_workflow.py:91

Bandit doesn't require the exact literal # nosec B602 to suppress this finding; plain # nosec, #nosec, and multi-ID forms also disable B602. This check leaves those suppression paths untested, so a future source-level bypass can slip in without failing CI.

        )

    def test_b602_is_not_suppressed_in_source(self):
        source_text = "\n".join(
            path.read_text(encoding="utf-8")
            for path in (REPO_ROOT / "src").rglob("*.py")
        )

Files reviewed: 5/5 changed files
Comments generated: 3

mnriem · 2026-05-05T20:34:15Z

Please address Copilot feedback

PascalThuet · 2026-05-05T20:45:51Z

Addressed the latest Copilot review in 129d19e:

Dependency audit now runs on the supported OS/Python matrix: ubuntu-latest and windows-latest across Python 3.11, 3.12, and 3.13.
The requirements output path in CI now uses ${{ runner.temp }}, and the contributor docs use a relative spec-kit-audit-requirements.txt path instead of /tmp, so the commands are Windows-compatible.
The security workflow regression test now verifies GitHub Actions are pinned to full 40-character commit SHAs.
The Bandit suppression guard now catches any # nosec form, not only the exact # nosec B602 spelling.
The dependency audit now compiles hashed requirements and runs pip-audit --disable-pip --require-hashes, avoiding a second pip resolution step.

Validation:

uv run python -m pytest tests/test_security_workflow.py -q
uv pip compile pyproject.toml --extra test --python-version 3.11 --generate-hashes --quiet --output-file /tmp/spec-kit-audit-py311.txt
uv pip compile pyproject.toml --extra test --python-version 3.12 --generate-hashes --quiet --output-file /tmp/spec-kit-audit-py312.txt
uv pip compile pyproject.toml --extra test --python-version 3.13 --generate-hashes --quiet --output-file /tmp/spec-kit-audit-py313.txt
uvx --from pip-audit==2.10.0 pip-audit --disable-pip --require-hashes -r /tmp/spec-kit-audit-py311.txt --progress-spinner off
uvx --from pip-audit==2.10.0 pip-audit --disable-pip --require-hashes -r /tmp/spec-kit-audit-py312.txt --progress-spinner off
uvx --from pip-audit==2.10.0 pip-audit --disable-pip --require-hashes -r /tmp/spec-kit-audit-py313.txt --progress-spinner off
uvx --from bandit==1.9.4 bandit -r src -lll --baseline .github/bandit-baseline.json
git diff --check

All passed locally.

Copilot

Copilot's findings

Files reviewed: 35/35 changed files
Comments generated: 2

Copilot

Copilot's findings

Files reviewed: 35/35 changed files
Comments generated: 2

mnriem

Please address Copilot feedback

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot's findings

Files reviewed: 36/36 changed files
Comments generated: 2

mnriem

Please address Copilot feedback

Copilot

Copilot's findings

Files reviewed: 36/36 changed files
Comments generated: 0 new

mnriem

Please resolve conflicts

+    try:
+        return json.loads(blob), True
+    except json.JSONDecodeError:
+        print(f"Could not parse baseline at {ref}; treating as empty.", file=sys.stderr)


Merge origin/main into the security audit PR, avoid logging the secrets baseline ref, and refresh security baselines after the merge.

Copilot

Pull request overview

Copilot reviewed 36 out of 36 changed files in this pull request and generated 4 comments.

+def _is_https_or_localhost_http(url: str) -> bool:
+    parsed = urlparse(url)
+    is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
+    return parsed.scheme == "https" or (parsed.scheme == "http" and is_localhost)


+def read_response_limited(
+    response,
+    *,
+    max_bytes: int = MAX_DOWNLOAD_BYTES,
+    error_type: type[ErrorT] = ValueError,
+    label: str = "download",
+) -> bytes:
+    """Read at most *max_bytes* from a response object."""
+    data = response.read(max_bytes + 1)
+    if len(data) > max_bytes:
+        _raise(error_type, f"{label} exceeds maximum size of {max_bytes} bytes")
+    return data


+def _raise(error_type: type[ErrorT], message: str) -> None:
+    raise error_type(message)
+
+
+def _raise_from(error_type: type[ErrorT], message: str, exc: Exception) -> None:
+    raise error_type(message) from exc


+        except (
+            urllib.error.URLError,
+            OSError,
+            ValueError,
+            KeyError,
+        ):
            return None


Add automated security audit workflow

e4b38e7

PascalThuet marked this pull request as ready for review May 2, 2026 06:45

PascalThuet requested a review from mnriem as a code owner May 2, 2026 06:45

mnriem requested a review from Copilot May 4, 2026 12:39

Copilot started reviewing on behalf of mnriem May 4, 2026 12:40 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

Comment thread .github/workflows/security.yml Outdated

Comment thread .github/workflows/security.yml Outdated

Comment thread .github/workflows/security.yml Outdated

Comment thread .github/workflows/security.yml Outdated

Comment thread .github/workflows/security.yml Outdated

mnriem requested changes May 4, 2026

View reviewed changes

Address security audit review feedback

65b0dab

Add security workflow regression tests

397e0d7

PascalThuet requested a review from mnriem May 5, 2026 16:50

mnriem requested a review from Copilot May 5, 2026 17:32

Copilot started reviewing on behalf of mnriem May 5, 2026 17:33 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

Comment thread .github/workflows/security.yml Outdated

Comment thread CONTRIBUTING.md Outdated

Comment thread tests/test_security_workflow.py Outdated

Comment thread src/specify_cli/workflows/steps/shell/__init__.py Outdated

Comment thread src/specify_cli/__init__.py Outdated

mnriem requested changes May 5, 2026

View reviewed changes

Address follow-up security workflow review

e1e8051

mnriem requested a review from Copilot May 5, 2026 20:22

Copilot started reviewing on behalf of mnriem May 5, 2026 20:22 View session

Use compile for security audit requirements

6f1da27

Copilot AI reviewed May 5, 2026

View reviewed changes

Comment thread .github/workflows/security.yml Outdated

Comment thread CONTRIBUTING.md Outdated

Comment thread tests/test_security_workflow.py Outdated

Address latest security workflow review

129d19e

mnriem requested a review from Copilot May 5, 2026 20:47

Copilot started reviewing on behalf of mnriem May 5, 2026 20:48 View session

PascalThuet requested a review from mnriem May 5, 2026 20:50

mnriem requested a review from Copilot May 18, 2026 15:44

Copilot started reviewing on behalf of mnriem May 18, 2026 15:44 View session

Copilot AI reviewed May 18, 2026

View reviewed changes

Comment thread tests/test_baseline_gates.py Outdated

Comment thread tests/test_download_security.py Outdated

ci(security): address follow-up review

4b1734e

mnriem requested a review from Copilot May 21, 2026 01:01

Copilot started reviewing on behalf of mnriem May 21, 2026 01:02 View session

Copilot AI reviewed May 21, 2026

View reviewed changes

Comment thread src/specify_cli/_github_http.py Outdated

Comment thread src/specify_cli/_utils.py Outdated

mnriem requested changes May 21, 2026

View reviewed changes

fix: address copilot security review follow-up

a2e53c2

PascalThuet requested a review from mnriem May 21, 2026 13:38

mnriem requested a review from Copilot May 26, 2026 12:03

Copilot started reviewing on behalf of mnriem May 26, 2026 12:19 View session

Copilot AI reviewed May 26, 2026

View reviewed changes

mnriem requested a review from Copilot May 27, 2026 12:05

Copilot started reviewing on behalf of mnriem May 27, 2026 12:05 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread src/specify_cli/_download_security.py

Comment thread src/specify_cli/_download_security.py

mnriem requested changes May 27, 2026

View reviewed changes

fix: wrap unsafe zip extraction errors

2957b83

PascalThuet requested a review from mnriem May 28, 2026 04:07

mnriem requested a review from Copilot May 28, 2026 13:16

Copilot started reviewing on behalf of mnriem May 28, 2026 13:16 View session

Copilot AI reviewed May 28, 2026

View reviewed changes

mnriem requested changes May 28, 2026

View reviewed changes

github-advanced-security AI found potential problems May 28, 2026

View reviewed changes

Comment thread .github/scripts/check_secrets_baseline.py Outdated

try:

return json.loads(blob), True

except json.JSONDecodeError:

print(f"Could not parse baseline at {ref}; treating as empty.", file=sys.stderr)

fix: address GHAS review and resolve conflicts

6ee9693

Merge origin/main into the security audit PR, avoid logging the secrets baseline ref, and refresh security baselines after the merge.

PascalThuet requested a review from mnriem May 28, 2026 22:01

fix: redact secrets baseline hash logs

48988e1

Copilot AI review requested due to automatic review settings May 29, 2026 22:12

Copilot AI reviewed May 29, 2026

View reviewed changes

fix: keep secrets baseline hashes out of repr

5a15b77

Conversation

PascalThuet commented May 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security context

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mnriem left a comment

Choose a reason for hiding this comment

Uh oh!

PascalThuet commented May 5, 2026

Uh oh!

PascalThuet commented May 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mnriem commented May 5, 2026

Uh oh!

mnriem left a comment

Choose a reason for hiding this comment

Uh oh!

PascalThuet commented May 5, 2026

Uh oh!

PascalThuet commented May 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mnriem commented May 5, 2026

Uh oh!

PascalThuet commented May 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

mnriem left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

mnriem left a comment

Choose a reason for hiding this comment

Uh oh!

PascalThuet commented May 2, 2026 •

edited

Loading