Security hardening: pinned actions, workflow permissions, .env, SECURITY.md

.github/workflows/ci.yml

@@ -9,14 +9,17 @@ env:
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
         with:
           components: rustfmt, clippy
 

.github/workflows/release.yml

@@ -12,36 +12,36 @@ jobs:
   binary:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
       - run: cargo build --release -p sbx-cli
       - name: package
         run: |
           strip target/release/sbx
           tar -C target/release -czf "sbx-${GITHUB_REF_NAME}-x86_64-unknown-linux-gnu.tar.gz" sbx
-      - uses: softprops/action-gh-release@v2
+      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: sbx-*.tar.gz
           generate_release_notes: true
 
   container:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/metadata-action@v5
+      - uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         id: meta
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
             type=ref,event=tag
             type=raw,value=latest
-      - uses: docker/build-push-action@v6
+      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           push: true

.gitignore

@@ -12,3 +12,8 @@ bench/out/figs-png/
 bench/out/*.output
 bench/out/_*.json
 bench/scripts/_*.sh
+
+# local secrets
+.env
+.env.*
+!.env.example

SECURITY.md

@@ -0,0 +1,18 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please do not open a public issue for security problems. Use GitHub's private
+vulnerability reporting for this repository (**Security → Report a
+vulnerability**), or contact the maintainer directly through the profile
+listed on the repository. You will get an acknowledgement within a few days.
+
+## Scope
+
+This is a personal open-source project. Reports about the code in this
+repository, its build and release workflows, and its published artifacts are
+in scope. Third-party services it talks to are not.
+
+## Supported versions
+
+Only the default branch and the latest release receive fixes.

bench/gpu/bootstrap.sh

@@ -4,7 +4,12 @@
 # Run on a fresh Ubuntu 22.04/24.04 pod that already has the NVIDIA driver + CUDA
 # (RunPod "PyTorch 2.x" template, or a Vast.ai CUDA image). One command:
 #
-#     curl -fsSL https://raw.githubusercontent.com/RARS-oss/sbx/main/bench/gpu/bootstrap.sh | bash
+#     curl -fsSL https://raw.githubusercontent.com/RARS-oss/sbx/8c38a4e54484102166f5a80947e2c40bed53663f/bench/gpu/bootstrap.sh -o bootstrap.sh
+#     sha256sum bootstrap.sh     # compare with the checksum in the commit / release notes you reviewed
+#     bash bootstrap.sh
+#
+# Fetch by commit (or a reviewed tag), never by branch: a branch URL executes whatever
+# is on that branch at the moment you run it. SBX_REF below pins the clone the same way.
 #
 # It: installs toolchains, builds `sbx`, creates a venv with vLLM + the harness deps,
 # downloads the model, and launches an OpenAI-compatible endpoint that the harness
@@ -30,9 +35,10 @@ PKGS="git curl build-essential clang python3 python3-venv python3-pip pkg-config
 sudo apt-get install -y -qq $PKGS 2>/dev/null || apt-get install -y -qq $PKGS
 
 log "2/5  rust + build sbx"
-if ! command -v cargo >/dev/null 2>&1; then curl -fsSL https://sh.rustup.rs | sh -s -- -y; fi
+if ! command -v cargo >/dev/null 2>&1; then curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal; fi
 . "$HOME/.cargo/env"
-[ -d sbx ] || git clone --depth 1 https://github.com/RARS-oss/sbx.git
+SBX_REF="${SBX_REF:-8c38a4e54484102166f5a80947e2c40bed53663f}"          # commit or tag to build; override to test a branch
+[ -d sbx ] || { git clone https://github.com/RARS-oss/sbx.git && git -C sbx checkout -q "$SBX_REF"; }
 ( cd sbx && cargo build --release -p sbx-cli )
 export PATH="$ROOT/sbx/target/release:$PATH"
 echo "sbx: $(sbx --version 2>/dev/null || echo built)"