Charon/docs/reports/qa_report.md

QA/Security Audit Report: security-pr.yml Workflow Fix

• Date: 2026-02-27
• Auditor: QA Security mode
• Scope: .github/workflows/security-pr.yml behavior fix only
• Overall verdict: PASS (scope-specific) with one out-of-scope repository security debt noted

Findings (Ordered by Severity)

🟡 IMPORTANT: Repository secret-scan debt exists (not introduced by scoped workflow change)

• Check: pre-commit run --hook-stage manual gitleaks-tuned-scan --all-files
• Result: FAIL (135 findings)
• Scope impact: touches_security_pr = 0 (no findings in .github/workflows/security-pr.yml)
• Evidence source: test-results/security/gitleaks-tuned-precommit.json
• Why this matters: Existing credential-like content raises background security risk even if unrelated to this workflow fix.
• Recommended remediation:
  1. Triage findings by rule/file and classify true positives vs allowed test fixtures.
  2. Add justified allowlist entries for confirmed false positives.
  3. Remove or rotate any real secrets immediately.
  4. Re-run gitleaks-tuned-scan until clean/accepted baseline is documented.

✅ No blocking defects found in the implemented workflow fix

• Deterministic event handling: validated in workflow logic.
• Artifact/image resolution hardening: validated in workflow logic.
• Security hardening: validated in workflow logic and lint gates.

Requested Validations

1) actionlint on security workflow

• Command:
  • pre-commit run actionlint --files .github/workflows/security-pr.yml
• Result: PASS
• Key output:
  • actionlint (GitHub Actions)..............................................Passed

2) pre-commit run --all-files

• Command:
  • pre-commit run --all-files
• Result: PASS
• Key output:
  • YAML/shell/actionlint/dockerfile/go vet/golangci-lint/version/LFS/type-check/frontend lint hooks passed.

3) Security scans/tasks relevant to workflow change (feasible locally)

• Executed:
  1. pre-commit run --hook-stage manual codeql-parity-check --all-files -> PASS
  2. pre-commit run --hook-stage manual codeql-check-findings --all-files -> PASS (no blocking HIGH/CRITICAL)
  3. pre-commit run --hook-stage manual gitleaks-tuned-scan --all-files -> FAIL (repo baseline debt; not in scoped file)
• Additional QA evidence:
  • bash scripts/local-patch-report.sh -> artifacts generated:
    • test-results/local-patch-report.md
    • test-results/local-patch-report.json

Workflow Behavior Verification

A) Deterministic event handling

Validated in .github/workflows/security-pr.yml:

• Manual dispatch input is required and validated as digits-only:
  • .github/workflows/security-pr.yml:10
  • .github/workflows/security-pr.yml:14
  • .github/workflows/security-pr.yml:71
  • .github/workflows/security-pr.yml:78
• workflow_run path constrained to successful upstream PR runs:
  • .github/workflows/security-pr.yml:31
  • .github/workflows/security-pr.yml:36
  • .github/workflows/security-pr.yml:38
• Explicit trust-boundary contract checks for upstream workflow name/event/repository:
  • .github/workflows/security-pr.yml:127
  • .github/workflows/security-pr.yml:130
  • .github/workflows/security-pr.yml:136
  • .github/workflows/security-pr.yml:143

Assessment: PASS for deterministic triggering and contract enforcement.

B) Artifact and image resolution hardening

Validated in .github/workflows/security-pr.yml:

• Artifact is mandatory in workflow_run/workflow_dispatch artifact path; failures are explicit (api_error/not_found):
  • .github/workflows/security-pr.yml:159
  • .github/workflows/security-pr.yml:185
  • .github/workflows/security-pr.yml:196
  • .github/workflows/security-pr.yml:214
  • .github/workflows/security-pr.yml:225
• Docker image load hardened with:
  • tar readability check
  • manifest.json multi-tag parsing (RepoTags[])
  • fallback to Loaded image ID
  • deterministic alias charon:artifact
  • .github/workflows/security-pr.yml:255
  • .github/workflows/security-pr.yml:261
  • .github/workflows/security-pr.yml:267
  • .github/workflows/security-pr.yml:273
  • .github/workflows/security-pr.yml:282
  • .github/workflows/security-pr.yml:295
  • .github/workflows/security-pr.yml:300
• Extraction consumes resolved alias output rather than reconstructed tag:
  • .github/workflows/security-pr.yml:333
  • .github/workflows/security-pr.yml:342

Assessment: PASS for deterministic artifact/image selection and prior mismatch risk mitigation.

C) Security hardening

Validated in .github/workflows/security-pr.yml:

• Least-privilege job permissions:
  • .github/workflows/security-pr.yml:40
  • .github/workflows/security-pr.yml:41
  • .github/workflows/security-pr.yml:42
  • .github/workflows/security-pr.yml:43
• Pinned action SHAs maintained for checkout/download/upload/CodeQL SARIF upload/Trivy action usage:
  • .github/workflows/security-pr.yml:48
  • .github/workflows/security-pr.yml:243
  • .github/workflows/security-pr.yml:365
  • .github/workflows/security-pr.yml:388
  • .github/workflows/security-pr.yml:397
  • .github/workflows/security-pr.yml:408

Assessment: PASS for workflow-level security hardening within scope.

DoD Mapping for Workflow-Only Change

Executed:

• actionlint scoped check: Yes (PASS)
• Full pre-commit: Yes (PASS)
• Workflow-relevant security manual checks (CodeQL parity/findings, gitleaks): Yes (2 PASS, 1 FAIL out-of-scope debt)
• Local patch report artifacts: Yes (generated)

N/A for this scope:

• Playwright E2E feature validation for app behavior: N/A (no app/runtime code changes)
• Backend/frontend unit coverage gates: N/A (no backend/frontend source modifications in audited fix)
• GORM check-mode gate: N/A (no model/database/GORM changes)
• Trivy app binary/image scan execution for changed runtime artifact: N/A locally for this audit (workflow logic audited; no image/runtime code delta in this fix)

Conclusion

The implemented fix in .github/workflows/security-pr.yml meets the requested goals for deterministic event handling, robust artifact/image resolution, and workflow security hardening. Required validation commands were executed and passed (actionlint, pre-commit --all-files), and additional feasible security checks were run. One repository-wide gitleaks debt remains and should be remediated separately from this workflow fix.