Security scan — 2026-08-17

[yo61-lastlight]

Reviewing 22 commits since 2026-08-10 (18868d8..08aa602). Findings here focus on SDLC and workflow changes — Dependabot, GitHub Code Scanning, and Renovate handle the rest. Tick the box once the underlying issue is resolved or recorded in SECURITY.md.

How to respond

Preferred flow — tick the boxes on the findings you want broken out, then comment:

• @last-light create issues — files one issue per ticked finding (default)

Other shortcuts:

• @last-light create issues for the criticals — every Critical finding (ticked or not)
• @last-light create issues for the highs — same, for High
• @last-light create issues for items 1, 3, 5 — specific items by number (1-based, top to bottom)
• @last-light create issues for all — every finding in this scan
• @last-light accept-risk for item N: <reason> — suppress this finding in future scans
• @last-light false-positive for item N: <reason> — suppress this finding in future scans
• Comment freely to ask questions or discuss

Summary

Severity	Count
Critical	0
High	0
Medium	2
Low	0
Total	2

Suppressed by SECURITY.md: 0 (accepted: 0, false-positives: 0). Below severity floor: 0.

Commits reviewed: 18868d8 fix(rulesets): track the zizmor→prek rename, and gate civi-…, 88ab5dc feat(module): enable secret scanning by default on public r…, 5733cec docs(decisions): generalise the post-apply PR re-trigger st…, be299ec feat(yo61): enable dependabot security updates on repos wit…, b1f77ad ci(deps): watch the pre-commit ecosystem with Dependabot (#…, 00c3c64 feat(yo61): enable issues on gh-release-stats (#56), 74f1585 feat(yo61): manage agent-team-topologies and commitlint-git…, 9be9ec7 chore(yo61): remove the applied import blocks (#58), 4c67ed1 ci: run the pre-commit hooks in CI (#59), c463e4 feat(yo61): add a required-checks gate to kuard (#60) +12 more

Findings

🔴 Critical (0)

No findings.

🟠 High (0)

No findings.

🟡 Medium (2)

• CI installs terraform-docs binary with no checksum verification — .github/workflows/ci.yaml:38 (claude · supply-chain-unverified-binary-download)

Details

          set -euo pipefail
          curl -fsSL "https://terraform-docs.io/dl/${VERSION}/terraform-docs-${VERSION}-linux-amd64.tar.gz" \
            | tar -xz -C /usr/local/bin terraform-docs
          chmod +x /usr/local/bin/terraform-docs
          terraform-docs --version

The new CI workflow (#59) downloads the terraform-docs binary over HTTPS from a pinned-version URL on terraform-docs.io and extracts it straight into /usr/local/bin for execution, with no SHA256 checksum or signature check. A compromise of terraform-docs.io or its CDN (or a TLS-interception point) could swap the tarball for a trojaned binary that then runs on every PR and push to main. The blast radius is bounded — the job has top-level permissions: {}, job-level contents: read, and persist-credentials: false, so a malicious binary could read repo contents and make outbound network calls but has no write token — but integrity of a CI tool that runs on every contribution is still worth pinning.

Suggested fix: Verify a pinned checksum after download, e.g. download to a temp file, echo "<expected-sha256> terraform-docs.tar.gz" | sha256sum -c -, then extract; or pull the release asset from the terraform-docs GitHub release and check it against the published checksums.txt. terraform-docs publishes checksums per release.

• homebrew-tap keeps stale approvals across pushes to PR branches — data/yo61/homebrew-tap.yaml:11 (claude · authz-review-dismissal-disabled)

Details

default_branch_ruleset_bypass_actors: []
# publish-bottles.yaml pushes the bottle commit to the bump PR branch and then
# squash-merges it. With dismissal on, that push dismisses lastlight's approval
# — the very approval the merge needs — and the merge fails on "At least 1
# approving review is required". Re-approval takes ~2min, well past the
# workflow's retry window, and its retry path is not idempotent (bottle assets
# already exist on the release). See homebrew-tap#104.
default_branch_ruleset_dismiss_stale_reviews_on_push: false
default_branch_ruleset_required_approving_review_count: 1

PR #63 introduces a per-repo default_branch_ruleset_dismiss_stale_reviews_on_push override (module default true) and sets it false on homebrew-tap, which is public and also has allow_auto_merge: true and required_approving_review_count: 1. With dismissal off, the publish-bottles workflow pushes a bottle commit onto an already-approved PR branch and the prior approval is retained, so the PR auto-merges on an approval that predates the pushed commit — the bottle commit itself is never re-reviewed by a human. The trade-off is documented in the YAML comment and decisions/2026-08-12-homebrew-tap-dismiss-stale-override.md as an operational necessity (re-approval exceeds the workflow's non-idempotent retry window). Flagging for visibility/sign-off because it is a real narrowing of the review gate on a public repo, consistent with how the 2026-08-10 scan treated the comparable unifi-mcp relaxation. Note also that #61 in this same window restores required_approving_review_count: 1 on unifi-mcp and go-udap, closing that prior finding.

Suggested fix: No code defect — this is an intentional, documented policy change. Confirm the accepted trade-off (a bottle commit merging on a stale approval, with the bottle commit produced by automation rather than reviewed) matches the intended risk posture for a public tap, then record it in SECURITY.md as an accepted risk so future scans don't re-surface it once reviewed.

🟢 Low (0)

No findings.