KofTwentyTwo/standards
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases 6 Wiki Activity

security.yml: run gitleaks and trivy as GitHub-hosted actions so consumers can restrict allowed actions (K22-REPO-32) #35

New Issue
Open
opened 2026-10-11 13:30:23 +00:00 by KofTwentyTwo · 0 comments
KofTwentyTwo commented 2026-10-11 13:30:23 +00:00 (Migrated from github.com)
Copy link
Copy source

The shared security workflow runs gitleaks and trivy as docker:// container steps. GitHub's 'Allow select actions' policy cannot allow docker:// references, so any consumer that applies K22-REPO-32 (allowed actions = GitHub-authored + verified + listed) gets a startup_failure on the security workflow. Seen on KofTwentyTwo/gclo on 2026-10-11 (KofTwentyTwo/gclo#66).

Proposal: replace the docker:// steps with pinned GitHub-hosted actions (gitleaks/gitleaks-action, aquasecurity/trivy-action), or document in repository.md that REPO-32 is not applicable while the shared workflow uses container steps.

The shared security workflow runs gitleaks and trivy as docker:// container steps. GitHub's 'Allow select actions' policy cannot allow docker:// references, so any consumer that applies K22-REPO-32 (allowed actions = GitHub-authored + verified + listed) gets a startup_failure on the security workflow. Seen on KofTwentyTwo/gclo on 2026-10-11 (KofTwentyTwo/gclo#66). Proposal: replace the docker:// steps with pinned GitHub-hosted actions (gitleaks/gitleaks-action, aquasecurity/trivy-action), or document in repository.md that REPO-32 is not applicable while the shared workflow uses container steps.
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
accessibility
Barrier affecting people with disabilities
 autorelease: failed
Reserved version tag; no published release
 autorelease: pending
autorelease: tagged
breaking
Incompatible new mandatory standards; requires a MAJOR release
 bug
Something isn't working
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 release: failed
Reserved release tag failed before public publication; preserved for audit.
 release: ready
Maintainer-approved release preflight
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#35