Skip to content

Commit 7ed5e90

Browse files
NestorMonroyNestorMonroy
authored
Merge pull request #280 from 2-Coatl/feature/review-github-workflows-for-improvements-23-09-35
Add per-workflow issues audit to GitHub Actions review
2 parents 0d6b7b3 + 7bc0baa commit 7ed5e90

2 files changed

Lines changed: 123 additions & 0 deletions

File tree

‎.github/workflows/PLAN_CORRECCION.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Plan de corrección de workflows de GitHub Actions
2+
3+
Este plan resume las acciones necesarias para corregir y optimizar los workflows bajo `.github/workflows/`, priorizando triggers completos (`push`, `pull_request`, `workflow_dispatch`), permisos mínimos, caching de dependencias, matrices de pruebas y controles de seguridad.
4+
5+
## Principios generales
6+
- **Triggers consistentes**: cada workflow debe soportar `push`, `pull_request` y `workflow_dispatch` salvo que exista una restricción explícita.
7+
- **Permisos mínimos**: definir `permissions` explícitos a nivel de workflow con el mínimo necesario (p. ej., `contents: read`, `pull-requests: write` solo cuando aplique).
8+
- **Caching**: habilitar `actions/cache` o cachés nativas (pip/npm) según el stack para reducir tiempos.
9+
- **Matrices de pruebas**: cubrir versiones soportadas (Python 3.10-3.12, Node 18-20) y SO donde aplique.
10+
- **Seguridad**: fijar versiones de acciones (SHA/digest cuando aplique), evitar secretos inline y añadir `concurrency` para evitar solapes.
11+
- **Observabilidad**: añadir upload de artefactos y resultados (coverage, logs) cuando aporte valor al debug.
12+
13+
## Acciones transversales
14+
1. Añadir plantilla base reutilizable para permisos mínimos y estrategia de caching (composite o reusable workflow).
15+
2. Incorporar `concurrency` para despliegue, incident-response y pipelines largos.
16+
3. Revisar secretos: documentar requeridos y validar existencia antes de usarlos (ej. `if: env.SECRET != ''`).
17+
4. Añadir validaciones de seguridad ligeras (Semgrep/Trivy) en ramas principales si no duplican CodeQL.
18+
5. Documentar en README de workflows los triggers esperados y variables.
19+
20+
## Acciones por workflow
21+
- **actionlint.yml**: fijar digest del contenedor y añadir cache para dependencias de verificación si aplica.
22+
- **agents-ci.yml**: añadir `permissions` mínimos; declarar `CODECOV_TOKEN` como `env` opcional con guardas; revisar que `bandit` falle en hallazgos críticos y habilitar cache pip.
23+
- **backend-ci.yml**: agregar `workflow_dispatch`; definir permisos mínimos; usar secretos no triviales para MySQL y cerrar puerto con `ports: ["3306:3306"]` solo si es estrictamente necesario; cache pip y matiz de Python 3.10-3.12; añadir `concurrency` por ref.
24+
- **code-quality.yml**: incluir `push` y `workflow_dispatch`; permisos mínimos; cache según herramienta (npm/pip); revisar matrices si hay múltiples linters.
25+
- **codeql.yml**: agregar `workflow_dispatch`; permisos mínimos (`security-events: write`, `contents: read`); cache de dependencias del lenguaje y fijar versiones de `actions/checkout`/`setup-*` por SHA.
26+
- **dependency-review.yml**: añadir `push` y `workflow_dispatch`; permisos mínimos (`contents: read`); documentar política de bloqueo.
27+
- **deploy.yml**: habilitar `pull_request` (dry-run), permisos mínimos; reusar artefactos de build con checksum; cache de dependencias; añadir `concurrency` por entorno y validaciones previas.
28+
- **docs-validation.yml**: sumar `workflow_dispatch`; permisos mínimos; cache pip y Sphinx; paralelizar validaciones si posible.
29+
- **docs.yml**: incorporar cache de dependencias y `concurrency` por ref; revisar publicación segura (sin write innecesario).
30+
- **emoji-validation.yml**: añadir `workflow_dispatch` y permisos mínimos; cache de dependencias y fijar versiones de acciones.
31+
- **frontend-ci.yml**: agregar `workflow_dispatch` y permisos mínimos; cache npm/pnpm; matriz Node 18-20; considerar `concurrency` por ref.
32+
- **incident-response.yml**: sumar `push`/`pull_request` si aplica; permisos mínimos; cache de herramientas; añadir `concurrency` para evitar ejecuciones paralelas.
33+
- **infrastructure-ci.yml**: añadir `workflow_dispatch`; permisos mínimos; cache de proveedores/Terraform; proteger `terraform apply` con `environment`; validar backend remoto.
34+
- **lint.yml**: agregar `workflow_dispatch`; permisos mínimos; cache de dependencias; fijar versiones de acciones.
35+
- **meta-architecture-check.yml**: definir permisos mínimos; cache de dependencias; fijar versiones.
36+
- **migrations.yml**: añadir `workflow_dispatch`; permisos mínimos; eliminar credenciales inline (`testpass`); cerrar puertos o usar servicios internos; cache pip; considerar matrices de DB si soportadas.
37+
- **pr-review.yml**: evaluar añadir `push`/`pull_request` o mantener sólo comentario pero con filtro `if: github.event.issue.pull_request` para limitar; cache dependencias; revisar permisos mínimos.
38+
- **python_ci.yml**: definir permisos mínimos; cache pip; añadir `concurrency`; ampliar matriz Python 3.10-3.12.
39+
- **release.yml**: incluir `pull_request` (dry-run); permisos explícitos; verificar integridad de artefactos; cache dependencias; añadir `concurrency` por versión/tag.
40+
- **requirements_index.yml**: añadir cache pip y matriz Python adicional; mantener permisos explícitos.
41+
- **requirements_validate_traceability.yml**: definir permisos mínimos; cache pip; fijar acciones.
42+
- **security-scan.yml**: sumar `workflow_dispatch`; permisos mínimos; cache cuando sea seguro; fijar versiones y limitar scope de escaneos.
43+
- **sync-docs.yml**: agregar `push`/`pull_request`; permisos mínimos; validar PAT/SSH presentes; cache dependencias; añadir `concurrency`.
44+
- **test-pyramid.yml**: añadir `workflow_dispatch`; permisos mínimos; cache pip; ampliar matriz Python; fijar acciones.
45+
- **validate-guides.yml**: definir permisos mínimos; cache dependencias; fijar versiones de acciones.
46+
47+
## Entregables
48+
- PRs incrementales por workflow o por categoría (permisos, triggers, caching) para reducir riesgo.
49+
- Documentación de cambios y secretos requeridos en cada PR.

‎WORKFLOW_AUDIT.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# GitHub Actions Workflow Audit
2+
3+
## Inventory
4+
| Workflow | Triggers | Jobs | Cache (actions/cache) | Explicit permissions |
5+
| --- | --- | ---: | :---: | :---: |
6+
| actionlint.yml | push, pull_request, workflow_dispatch | 1 | No | Yes |
7+
| agents-ci.yml | push, pull_request, workflow_dispatch | 7 | No | No |
8+
| backend-ci.yml | push, pull_request | 6 | Yes | No |
9+
| code-quality.yml | pull_request, workflow_dispatch | 1 | No | No |
10+
| codeql.yml | push, pull_request, schedule | 1 | No | No |
11+
| dependency-review.yml | pull_request | 1 | No | No |
12+
| deploy.yml | push, workflow_dispatch | 7 | No | No |
13+
| docs-validation.yml | pull_request, push | 6 | No | No |
14+
| docs.yml | push, pull_request, workflow_dispatch | 3 | No | Yes |
15+
| emoji-validation.yml | pull_request, push | 1 | No | No |
16+
| frontend-ci.yml | push, pull_request | 8 | No | No |
17+
| incident-response.yml | workflow_dispatch | 5 | No | No |
18+
| infrastructure-ci.yml | push, pull_request | 7 | No | No |
19+
| lint.yml | pull_request, push | 1 | No | No |
20+
| meta-architecture-check.yml | pull_request, push, workflow_dispatch | 2 | No | No |
21+
| migrations.yml | pull_request, push | 5 | No | No |
22+
| pr-review.yml | issue_comment | 1 | No | Yes |
23+
| python_ci.yml | push, pull_request, workflow_dispatch | 5 | No | No |
24+
| release.yml | push, workflow_dispatch | 7 | No | Yes |
25+
| requirements_index.yml | push, pull_request, workflow_dispatch | 1 | No | Yes |
26+
| requirements_validate_traceability.yml | pull_request, push, workflow_dispatch | 1 | No | No |
27+
| security-scan.yml | push, pull_request, schedule | 11 | No | No |
28+
| sync-docs.yml | schedule, workflow_dispatch | 2 | No | No |
29+
| test-pyramid.yml | push, pull_request, schedule | 3 | No | No |
30+
| validate-guides.yml | pull_request, push, workflow_dispatch | 5 | No | No |
31+
32+
## Quick findings
33+
- Total workflows: 25.
34+
- Workflows with `workflow_dispatch`: 13/25.
35+
- Missing `workflow_dispatch`: backend-ci.yml, codeql.yml, dependency-review.yml, docs-validation.yml, emoji-validation.yml, frontend-ci.yml, infrastructure-ci.yml, lint.yml, migrations.yml, pr-review.yml, security-scan.yml, test-pyramid.yml
36+
- Missing `push` trigger: code-quality.yml, dependency-review.yml, incident-response.yml, pr-review.yml, sync-docs.yml
37+
- Missing `pull_request` trigger: deploy.yml, incident-response.yml, pr-review.yml, release.yml, sync-docs.yml
38+
- Lacking explicit top-level `permissions`: agents-ci.yml, backend-ci.yml, code-quality.yml, codeql.yml, dependency-review.yml, deploy.yml, docs-validation.yml, emoji-validation.yml, frontend-ci.yml, incident-response.yml, infrastructure-ci.yml, lint.yml, meta-architecture-check.yml, migrations.yml, python_ci.yml, requirements_validate_traceability.yml, security-scan.yml, sync-docs.yml, test-pyramid.yml, validate-guides.yml
39+
- Workflows without `actions/cache`: actionlint.yml, agents-ci.yml, code-quality.yml, codeql.yml, dependency-review.yml, deploy.yml, docs-validation.yml, docs.yml, emoji-validation.yml, frontend-ci.yml, incident-response.yml, infrastructure-ci.yml, lint.yml, meta-architecture-check.yml, migrations.yml, pr-review.yml, python_ci.yml, release.yml, requirements_index.yml, requirements_validate_traceability.yml, security-scan.yml, sync-docs.yml, test-pyramid.yml, validate-guides.yml
40+
41+
## Recommendations
42+
- Add `workflow_dispatch` to workflows that currently only run on PR/push to enable manual runs during incidents or hotfix validation.
43+
- Define explicit, least-privilege `permissions` blocks to avoid default write scopes (e.g., contents: read, pull-requests: write only where needed).
44+
- Introduce dependency caching where missing (pip, npm, etc.) to speed up jobs; most workflows reinstall dependencies from scratch.
45+
- Expand test matrices for Python/Node where appropriate (e.g., backend/agents run single Python 3.11, frontend fixed to Node 18).
46+
- Consider a lightweight security gate (e.g., Semgrep or Trivy) on push to main/develop to complement existing CodeQL and security scans.
47+
- Add concurrency keys to long-running workflows (deploy, incident-response) to prevent overlapping runs per ref/environment.
48+
49+
## Per-workflow issues and gaps
50+
- **actionlint.yml**: Uses explicit permissions and manual trigger is present, but there is no caching and the Docker action is not pinned to a digest.
51+
- **agents-ci.yml**: Lacks an explicit permissions block, requires `CODECOV_TOKEN` to run coverage uploads, and the Bandit step ignores findings by design (`|| true`).
52+
- **backend-ci.yml**: Missing `workflow_dispatch`; no permissions block; database service uses default MySQL root credentials and exposes 3306.
53+
- **code-quality.yml**: Only runs on `pull_request` and `workflow_dispatch` is absent; no explicit permissions; no dependency caching.
54+
- **codeql.yml**: Lacks `workflow_dispatch`; permissions not explicitly narrowed for code scanning upload; no cache for Python setup.
55+
- **dependency-review.yml**: Only trigger is `pull_request`; no manual trigger; permissions block present but default read/write not narrowed to minimal contents/read.
56+
- **deploy.yml**: Does not run on `pull_request`; no permissions block; re-runs full test suite without caching, slowing deployments.
57+
- **docs-validation.yml**: Missing `workflow_dispatch` and explicit permissions; no caching for Python or Sphinx deps.
58+
- **docs.yml**: Triggers are complete and permissions are explicit, but there is no dependency cache and no concurrency control for doc publishes.
59+
- **emoji-validation.yml**: Missing manual trigger; no permissions block; re-installs dependencies every run.
60+
- **frontend-ci.yml**: Missing `workflow_dispatch`; no permissions block; npm/node dependencies are not cached and only Node 18 is covered.
61+
- **incident-response.yml**: Manual-only trigger with no `push`/`pull_request`; lacking permissions block and dependency caching.
62+
- **infrastructure-ci.yml**: Missing `workflow_dispatch` and permissions block; Terraform steps lack a backend/cache and may need environment protection.
63+
- **lint.yml**: Missing `workflow_dispatch` and permissions block; no caching for lint dependencies.
64+
- **meta-architecture-check.yml**: Triggers present, but no permissions block and no dependency caching.
65+
- **migrations.yml**: Missing `workflow_dispatch`; no permissions block; seeds data with inline secrets (`testpass`) and exposes MySQL port 3306.
66+
- **pr-review.yml**: Triggered only by `issue_comment` with no `push`/`pull_request`; permissions are constrained but there is no validation to limit to PR comments; no caching.
67+
- **python_ci.yml**: Triggers present but lacks permissions block; no cache for Python dependencies and no concurrency control.
68+
- **release.yml**: No `pull_request` trigger; permissions rely on defaults; reuses build artifacts without checksum verification.
69+
- **requirements_index.yml**: Triggers present and permissions explicit, but there is no cache and the Python job runs only on a single version.
70+
- **requirements_validate_traceability.yml**: Triggers present but no permissions block; no dependency caching.
71+
- **security-scan.yml**: Missing `workflow_dispatch` and permissions block; no caching and uses broad third-party actions without digests.
72+
- **sync-docs.yml**: Missing `push`/`pull_request` triggers; no permissions block; relies on PAT/SSH secrets without validation and lacks caching.
73+
- **test-pyramid.yml**: Missing `workflow_dispatch`; no permissions block; Python jobs reuse `pip install` without cache and matrix lacks latest versions.
74+
- **validate-guides.yml**: Triggers are complete, but permissions are not explicit and there is no dependency caching.

0 commit comments

Comments
 (0)