Security: triage May 2026 code scanning alerts#45740
Conversation
Address 6 of 10 open code scanning alerts on main. CVEs: - CVE-2026-33532 (yaml DoS): add "**/yaml": "^1.10.3" resolution. yaml@1.10.2 was pulled in transitively via cosmiconfig (build/dev tooling only — no untrusted YAML at runtime), but patching is cheap. Supply-chain pinning (Scorecard): - trivy-close-legacy.yml: pin codeql-action/upload-sarif to SHA - fleetd-linux/{fedora-43,debian-13.4}/Dockerfile: pin base image digest - test-go.yaml, test-go-suite.yaml: pin gotestsum@latest -> @v1.13.0 False positive: - ee/fleet-agent-downloader/config/custom.js: add to existing trivy-scan.yml skip-files list. Same Sails template as website/config/custom.js (already skipped); the flagged Stripe key is a commented-out pk_test_ publishable placeholder. Not addressed in this PR: - Scorecard npmCommand alerts on fleet-agent-downloader workflows (#1651, #1652) — require generating a package-lock.json and switching to npm ci. Belongs with the app owners. - moby/docker CVE-2026-33997 (#1811) — docker dep is only used in test/upgrade harness, no plugin install code path. Defer to next dep-bump cycle.
Scorecard's "goCommand not pinned by hash" check wants a commit hash, not a tag. Replace @v1.13.0 with the commit SHA and keep the tag in a trailing comment for readability.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #45740 +/- ##
==========================================
+ Coverage 66.75% 66.76% +0.01%
==========================================
Files 2745 2747 +2
Lines 219339 219724 +385
Branches 10848 11010 +162
==========================================
+ Hits 146420 146709 +289
- Misses 59691 59763 +72
- Partials 13228 13252 +24
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
lukeheath
requested review from
georgekarrv,
lucasmrod and
sharon-fdm
as code owners
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
WalkthroughThis PR applies deterministic pinning across the build system infrastructure. GitHub Actions workflows now reference specific versions of Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/trivy-close-legacy.yml:
- Line 28: The GitHub Action pin
`github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571` is
labeled v3.24.6 but the SHA doesn't match; update the reference for consistency
by either replacing the pinned SHA with the correct v3.24.6 commit
`dafdd0a215b77395467a765b26d982dfc030f847` or change the comment/tag to reflect
the actual commit you intend to pin (edit the `uses:` entry
`github/codeql-action/upload-sarif@...` and the adjacent version comment
accordingly).
In `@tools/fleetd-linux/debian-13.4/Dockerfile`:
- Line 1: The FROM line in the Dockerfile uses the wrong digest for debian:13.4;
update the Dockerfile's FROM statement (the image reference beginning with "FROM
debian:13.4@sha256:...") to use the correct amd64 digest
sha256:3352c2e13876c8a5c5873ef20870e1939e73cb9a3c1aeba5e3e72172a85ce9ed so the
image reference matches the debian:13.4 tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 074d0c3c-1777-4179-b0bc-16ed869bd481
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (7)
.github/workflows/test-go-suite.yaml.github/workflows/test-go.yaml.github/workflows/trivy-close-legacy.yml.github/workflows/trivy-scan.ymlpackage.jsontools/fleetd-linux/debian-13.4/Dockerfiletools/fleetd-linux/fedora-43/Dockerfile
There was a problem hiding this comment.
Pull request overview
This PR addresses code scanning and supply-chain pinning alerts by pinning selected dependencies/actions/images and updating the JavaScript lockfile for security-related dependency resolution.
Changes:
- Pins GitHub Actions, Go tooling installation, and Linux Docker base images to immutable references.
- Locks selected
package.jsondependency/resolution ranges and updatesyarn.lock, includingyaml1.10.3. - Adds the fleet agent downloader Sails config template to Trivy’s skipped files for known placeholder Stripe keys.
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
yarn.lock |
Updates lockfile entries to match exact pins and resolve yaml to 1.10.3. |
tools/fleetd-linux/fedora-43/Dockerfile |
Pins the Fedora 43 base image to a digest. |
tools/fleetd-linux/debian-13.4/Dockerfile |
Pins the Debian 13.4 base image to a digest. |
package.json |
Replaces selected dependency and resolution ranges with exact versions and adds a yaml resolution. |
.github/workflows/trivy-scan.yml |
Adds the fleet agent downloader config template to Trivy skipped files. |
.github/workflows/trivy-close-legacy.yml |
Pins github/codeql-action/upload-sarif to a commit SHA. |
.github/workflows/test-go.yaml |
Pins gotestsum installation to a commit SHA. |
.github/workflows/test-go-suite.yaml |
Pins reusable Go suite gotestsum installation to the same commit SHA. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary
Addresses 6 of 10 open code scanning alerts on
main(Trivy + Scorecard), and locks every entry inpackage.jsonto an exact version while we're in there.CVEs
"**/yaml": "1.10.3"toresolutions, bumps transitiveyaml1.10.2 → 1.10.3. Source path was cosmiconfig (build/dev tooling only — no untrusted YAML parsing at runtime), but patching is cheap.Supply-chain pinning (Scorecard)
trivy-close-legacy.yml— pincodeql-action/upload-sarif@v3to SHA8a470fdd…(same pin used elsewhere in this repo).tools/fleetd-linux/fedora-43/Dockerfile— pinFROM fedora:43to digest.tools/fleetd-linux/debian-13.4/Dockerfile— pinFROM debian:13.4to digest.test-go.yaml—go install gotest.tools/gotestsum@latest→@c4a0df2e75a225d979a444342dd3db752b53619f(commit SHA forv1.13.0).test-go-suite.yaml— same.False positive
pk_test_token inee/fleet-agent-downloader/config/custom.js. It's a commented-out publishable key (public by design) in a Sails config template. Added the path to the existingskip-fileslist intrivy-scan.yml, alongside the identicalwebsite/config/custom.jsskip that's already there.Dependency hygiene
^and~range inpackage.jsonwith the exact version currently inyarn.lock. Affectspostcss,@tsconfig/recommended,typescript, and fourresolutionsentries (css-node-extract,css-node-extract/postcss,css-selector-extract,wait-on/axios). One side effect:wait-on/axioshad been silently floating to0.28.1under the previous^0.28.0; pinned at0.28.1.Test plan
test-go/test-go-suiteafter gotestsum SHA pin).yarn installproduces a clean lockfile (now hasyaml@1.10.3and exact pins).Summary by CodeRabbit