From 1a2a2364ec6b6df19d3c3b1a8fde2162d9801e98 Mon Sep 17 00:00:00 2001 From: Steve Dudenhoeffer Date: Sat, 27 Jun 2026 21:18:59 -0400 Subject: [PATCH] security: scope forwarded secrets + pin gadfly reusable to an immutable sha MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address the swarm's findings on this rollout: - Replace `secrets: inherit` (which forwarded ALL repo secrets — registry/ Komodo/Discord/DB creds the reviewer never uses) with explicit forwarding of only OLLAMA_CLOUD_API_KEY / CLAUDE_CODE_OAUTH_TOKEN / findings tokens. GITEA_TOKEN is the automatic job token (github.token in the reusable). - Pin uses: ...@main -> @20a5c43 (immutable) so a push to gadfly can't change the code that runs with our forwarded secrets. Requires gadfly's review-reusable.yml secrets contract (steve/gadfly#9, merged). Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/adversarial-review.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/adversarial-review.yml b/.gitea/workflows/adversarial-review.yml index fa2d5a3..3a6c1ea 100644 --- a/.gitea/workflows/adversarial-review.yml +++ b/.gitea/workflows/adversarial-review.yml @@ -36,8 +36,15 @@ jobs: && (github.actor == 'steve' || github.actor == 'fizi' || github.actor == 'dazed')) - uses: steve/gadfly/.gitea/workflows/review-reusable.yml@main - secrets: inherit + # Pinned to an immutable gadfly commit (not @main): a push to gadfly can't + # silently change the code that runs with our forwarded secrets. + uses: steve/gadfly/.gitea/workflows/review-reusable.yml@20a5c431f22d43bab0f711c14ce74de3a735c110 + # Least privilege: forward ONLY the secrets this swarm uses (GITEA_TOKEN is auto). + secrets: + OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }} + CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + GADFLY_FINDINGS_URL: ${{ secrets.GADFLY_FINDINGS_URL }} + GADFLY_FINDINGS_TOKEN: ${{ secrets.GADFLY_FINDINGS_TOKEN }} with: models: "minimax-m3:cloud,glm-5.2:cloud,glm-5.1:cloud,deepseek-v4-pro:cloud,nemotron-3-super:cloud,qwen3-coder:480b-cloud,claude-code/sonnet,claude-code/opus,claude-code/opus:max" specialists: "security,correctness,error-handling"