From f15e2632deee4f24549a012589f42968ae053a67 Mon Sep 17 00:00:00 2001 From: Savio Dias Date: Fri, 7 Aug 2026 14:51:44 +0530 Subject: [PATCH 1/2] fix(ci): pin actions to SHAs, add beta provenance, verify publisher binary Addresses PMAA-106 security retest (2026-07-31): - Pin all GitHub Action references to full commit SHAs across all 4 workflows - Add --provenance to beta-release.yml npm publish (with id-token: write) - Verify mcp-publisher download against pinned SHA-256 before execution (INF-006) Co-Authored-By: Claude Fable 5 --- .github/workflows/beta-release.yml | 7 ++++--- .github/workflows/mcp-ci.yml | 4 ++-- .github/workflows/mcp-registry-publish.yml | 12 +++++++++--- .github/workflows/npm-publish.yml | 6 +++--- 4 files changed, 18 insertions(+), 11 deletions(-) diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml index 900da5c4..5944ac73 100644 --- a/.github/workflows/beta-release.yml +++ b/.github/workflows/beta-release.yml @@ -5,18 +5,19 @@ on: permissions: contents: read + id-token: write jobs: publish-beta: runs-on: ubuntu-latest steps: - name: "Checkout source code" - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: "Set up Node.js" - uses: actions/setup-node@v4 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x registry-url: "https://registry.npmjs.org/" @@ -67,7 +68,7 @@ jobs: npm version ${{ steps.get_version.outputs.version }} --no-git-tag-version - name: "Publish beta to NPM" - run: npm publish --tag beta --access public + run: npm publish --tag beta --access public --provenance env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/.github/workflows/mcp-ci.yml b/.github/workflows/mcp-ci.yml index 0670b56e..4d7a41d2 100644 --- a/.github/workflows/mcp-ci.yml +++ b/.github/workflows/mcp-ci.yml @@ -17,9 +17,9 @@ jobs: node-version: [22.x] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v3 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: ${{ matrix.node-version }} - run: npm ci diff --git a/.github/workflows/mcp-registry-publish.yml b/.github/workflows/mcp-registry-publish.yml index a91b0811..8c2f6036 100644 --- a/.github/workflows/mcp-registry-publish.yml +++ b/.github/workflows/mcp-registry-publish.yml @@ -14,10 +14,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v5 + uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 - name: Setup Node.js - uses: actions/setup-node@v5 + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 with: node-version: "lts/*" @@ -31,8 +31,14 @@ jobs: run: npm run build --if-present - name: Install MCP Publisher + env: + MCP_PUBLISHER_VERSION: v1.3.3 + # sha256 of mcp-publisher_linux_amd64.tar.gz from registry_1.3.3_checksums.txt + MCP_PUBLISHER_SHA256: 1113b9d6bf59b000966c4f17752cf87b51db03dcc5482721421fd843ce3bf048 run: | - curl -L "https://github.com/modelcontextprotocol/registry/releases/download/v1.3.3/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher + curl -fsSL -o mcp-publisher.tar.gz "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz" + echo "${MCP_PUBLISHER_SHA256} mcp-publisher.tar.gz" | sha256sum --check + tar xzf mcp-publisher.tar.gz mcp-publisher - name: Login to MCP Registry run: ./mcp-publisher login github-oidc diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 8423e771..56dd4fb7 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -12,12 +12,12 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout source code" - uses: actions/checkout@v2 + uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 with: fetch-depth: 0 - name: "Set up Node.js" - uses: actions/setup-node@v3 + uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 with: node-version: 22.x registry-url: "https://registry.npmjs.org/" @@ -105,7 +105,7 @@ jobs: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: "Create GitHub Release" - uses: actions/create-release@v1 + uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4 with: tag_name: ${{ steps.get_version.outputs.version }} release_name: ${{ steps.get_version.outputs.version }} From 09a3362f034d4b6a0c6373f5a52d2d9a807bf8c5 Mon Sep 17 00:00:00 2001 From: Savio Dias Date: Fri, 7 Aug 2026 16:49:41 +0530 Subject: [PATCH 2/2] fix(ci): move release workflow to supported action majors, drop archived create-release Review follow-ups on PR #364: - checkout v2.8.0 -> v4.4.0, setup-node v3.9.1 -> v4.4.0 (same verified SHAs used elsewhere in this PR; v2/v3 lines are EOL and unpatched) - replace archived actions/create-release with gh release create, passing PR-derived notes via env vars instead of expression interpolation Co-Authored-By: Claude Fable 5 --- .github/workflows/npm-publish.yml | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 56dd4fb7..1d02327a 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -12,12 +12,12 @@ jobs: runs-on: ubuntu-latest steps: - name: "Checkout source code" - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 - name: "Set up Node.js" - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 with: node-version: 22.x registry-url: "https://registry.npmjs.org/" @@ -105,13 +105,14 @@ jobs: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: "Create GitHub Release" - uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4 - with: - tag_name: ${{ steps.get_version.outputs.version }} - release_name: ${{ steps.get_version.outputs.version }} - body: | - ${{ steps.fetch_prs.outputs.pr_list }} - - Published by ${{ github.actor }} env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION: ${{ steps.get_version.outputs.version }} + PR_LIST: ${{ steps.fetch_prs.outputs.pr_list }} + ACTOR: ${{ github.actor }} + run: | + gh release create "$VERSION" \ + --title "$VERSION" \ + --notes "$PR_LIST + + Published by $ACTOR"