Gate the release on a security job, and sign what it publishes

Renders the tui-kit templates that grew the security gate. CI now runs
govulncheck and gitleaks — over the working tree and over the whole history —
and the release job waits on them, so a v* tag that fails either check
produces no release.

A release now carries a CycloneDX SBOM per archive, a keyless cosign signature
over checksums.txt as a Sigstore bundle, and build provenance for every
archive, package and the checksum file. tui-kit's README says how to check
them.

gosec joins the lint bar; the one finding it raised is a fixture read in a
test, annotated on the line.

Adds the Scorecard workflow, which publishes this repository's supply-chain
score weekly, and the badge that shows it.

Author: edimarlnx

.github/workflows/ci.yml

@@ -1,6 +1,8 @@
 # Generated from tui-kit/templates/ci.yml. It runs the same checks
-# `make check` runs locally, cross-compiles for both release targets, and on a
-# `v*` tag lets GoReleaser publish the binaries.
+# `make check` runs locally, cross-compiles for both release targets, scans
+# for known vulnerabilities and committed secrets, and on a `v*` tag lets
+# GoReleaser publish the binaries — signed, with an SBOM and build provenance
+# beside them. A tag that fails any of those jobs produces no release.
 name: CI
 
 on:
@@ -146,13 +148,73 @@ jobs:
           python3 "$kit/tools/check-nfpm.py" --manifest tool.json \
             --config .goreleaser.yaml
 
+  security:
+    name: vulnerabilities and secrets
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # gitleaks reads the whole history: a secret that was committed
+          # once stays reachable long after the commit that removed it.
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v7
+        with:
+          # go.mod is the single place the family's Go version lives, so a
+          # bump there moves CI with it.
+          go-version-file: go.mod
+          check-latest: true
+
+      # Reports only the vulnerabilities the build actually reaches, so a CVE
+      # in an unused corner of a dependency does not stop a release while a
+      # reachable one does.
+      - name: govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+      # The official gitleaks action requires a paid license for repositories
+      # owned by an organization, and this one is. The released binary is the
+      # same scanner without that condition; it is pinned to a version and its
+      # checksum is verified against the release's own checksums file before
+      # it is allowed to run.
+      # It is unpacked outside the checkout, into the runner's temp
+      # directory: the working-tree scan below would otherwise read the
+      # scanner's own binary as if it were part of the repository.
+      - name: install gitleaks
+        env:
+          GITLEAKS_VERSION: "8.30.1"
+        run: |
+          base="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
+          asset="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          cd "$RUNNER_TEMP"
+          curl -fsSL --retry 3 -o "$asset" "$base/$asset"
+          curl -fsSL --retry 3 -o checksums.txt \
+            "$base/gitleaks_${GITLEAKS_VERSION}_checksums.txt"
+          grep " ${asset}$" checksums.txt | sha256sum -c -
+          tar xzf "$asset" gitleaks
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+
+      - name: gitleaks (history)
+        run: gitleaks git --no-banner --redact --config .gitleaks.toml
+
+      # The working tree as well as the history: a file that is present but
+      # not committed yet is the one worth catching early.
+      - name: gitleaks (working tree)
+        run: gitleaks dir --no-banner --redact --config .gitleaks.toml
+
   release:
     name: release
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: [check, cross-build, manifest]
+    needs: [check, cross-build, manifest, security]
     runs-on: ubuntu-latest
     permissions:
+      # contents to attach the artifacts, id-token for the keyless signing
+      # identity, attestations to record the provenance GitHub then serves to
+      # `gh attestation verify`.
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v7
         with:
@@ -165,9 +227,27 @@ jobs:
           go-version-file: go.mod
           check-latest: true
 
+      # Both are called by GoReleaser itself: syft for the `sboms` section,
+      # cosign for the `signs` one. They have to be on PATH before it runs.
+      - uses: anchore/sbom-action/download-syft@v0
+      - uses: sigstore/cosign-installer@v4
+
       - uses: goreleaser/goreleaser-action@v7
         with:
           version: "~> v2"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # Provenance: a signed statement of which workflow, at which commit,
+      # produced each file. `gh attestation verify <file> -R tui-tools/tui-firewall`
+      # checks a download against it without any key to distribute.
+      - name: attest build provenance
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: |
+            dist/*.tar.gz
+            dist/*.deb
+            dist/*.rpm
+            dist/*.pkg.tar.zst
+            dist/checksums.txt

.github/workflows/scorecard.yml

@@ -0,0 +1,57 @@
+# Generated from tui-kit/templates/scorecard.yml.
+#
+# Scorecard grades the repository's own supply-chain posture — branch
+# protection, pinned actions, signed releases, whether a security policy
+# exists — from the outside, the same way a person deciding whether to trust
+# the tool would. Publishing the result is the point: the score is public and
+# the badge links to the run that produced it, so the claim is checkable
+# rather than asserted.
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    # Weekly. The score moves with GitHub settings and with dependencies, not
+    # only with commits, so it has to run on a clock as well as on a push.
+    - cron: "27 5 * * 1"
+  push:
+    branches: [main]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: analyze
+    runs-on: ubuntu-latest
+    permissions:
+      # Upload the findings to the repository's code scanning view.
+      security-events: write
+      # Publish the result to the public OpenSSF API, which is what lets the
+      # badge and deps.dev read it. Keyless, via the workflow's OIDC token.
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: run analysis
+        uses: ossf/scorecard-action@v2
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Kept for a while as a plain file too: code scanning only retains the
+      # latest, and a regression is easier to read against the previous run.
+      - uses: actions/upload-artifact@v7
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: results.sarif

.gitleaks.toml

@@ -0,0 +1,42 @@
+# Secret scanning configuration for the tui-tools family.
+#
+# Copy to .gitleaks.toml at the root of the tool's repository, unchanged. CI
+# runs it twice: over the whole git history, because a secret that was
+# committed once stays reachable long after the commit that removed it, and
+# over the working tree, so a file that is not committed yet is caught first.
+[extend]
+# The upstream rule set is the baseline; this file only adds to it.
+useDefault = true
+
+# Not a secret, but it leaks whose machine built the artifact and how that
+# machine is laid out. It arrives the same way every time: a fixture, a log or
+# a terminal capture taken on a real workstation and committed verbatim.
+# Anything captured that way has to be scrubbed to a neutral path before it
+# lands in a public repository — /home/user, /root, or the placeholder the
+# surrounding document already uses.
+#
+# The username is the capture group rather than the whole path, because the
+# upstream allowlist drops any finding containing a common word and "home"
+# is one of them. Matching on the name also makes the allowlist below read
+# for what it is: the names that belong to a machine image, not a person.
+[[rules]]
+id = "developer-home-path"
+description = "Absolute home directory path from a developer machine"
+regex = '''(?:/home/|/Users/)([A-Za-z][A-Za-z0-9_-]*)/'''
+secretGroup = 1
+tags = ["privacy", "path"]
+
+[rules.allowlist]
+regexTarget = "secret"
+regexes = [
+  '''^(user|username|you|me|example|root|runner|ubuntu|debian|fedora|arch|vagrant|linuxbrew|Shared)$''',
+]
+
+# Build output. CI scans a fresh checkout, where none of this exists, but a
+# developer running the same command locally would otherwise be shown their
+# own compiled caches instead of a real finding.
+[allowlist]
+description = "Generated build output, never committed"
+paths = [
+  '''(^|/)(bin|dist|__pycache__)/''',
+]

.golangci.yml

@@ -11,6 +11,12 @@ linters:
   enable:
     - errcheck
     - govet
+    # The tools run privileged commands on someone else's machine, so the
+    # security linter is part of the bar rather than an occasional audit.
+    # The one finding the family expects is G204 inside internal/<backend>/,
+    # where an argv built from user input is the whole point; that line
+    # carries a //nolint saying so.
+    - gosec
     - ineffassign
     - staticcheck
     - unused

.goreleaser.yaml

@@ -5,8 +5,9 @@
 #   git tag v0.1.0 && git push origin v0.1.0
 #
 # CI runs `goreleaser release` on a v* tag and attaches static linux/amd64 and
-# linux/arm64 archives to the GitHub release. Generated from the template in
-# tui-kit/templates/.goreleaser.yaml.
+# linux/arm64 archives to the GitHub release, each with its SBOM, plus a
+# checksums.txt carrying a keyless cosign signature. Generated from the
+# template in tui-kit/templates/.goreleaser.yaml.
 version: 2
 
 project_name: tui-firewall
@@ -99,6 +100,43 @@ nfpms:
 checksum:
   name_template: checksums.txt
 
+# One SBOM per archive, in CycloneDX JSON, generated by syft from the archive
+# itself rather than from the source tree, so it describes what was actually
+# shipped. The release job installs syft before calling GoReleaser.
+sboms:
+  - id: archive
+    artifacts: archive
+    documents:
+      - "${artifact}.cyclonedx.json"
+    cmd: syft
+    args:
+      - "$artifact"
+      - --output
+      - cyclonedx-json=$document
+
+# Keyless signing: cosign gets its identity from the workflow's OIDC token,
+# so there is no signing key to hold, rotate or leak, and the certificate
+# names the workflow and the tag that produced the file.
+#
+# Only checksums.txt is signed. It already names every archive and every
+# package with its digest, so one signature covers the whole release: verify
+# the file, then `sha256sum -c` whatever you downloaded against it.
+#
+# The output is a Sigstore bundle — certificate, signature and transparency
+# log entry in one file — which is what `cosign verify-blob --bundle` reads.
+signs:
+  - id: checksums
+    cmd: cosign
+    args:
+      - sign-blob
+      - --yes
+      - --bundle
+      - "${signature}"
+      - "${artifact}"
+    artifacts: checksum
+    signature: "${artifact}.sigstore.json"
+    output: true
+
 snapshot:
   version_template: "{{ incpatch .Version }}-next"
 

README.md

@@ -1,5 +1,7 @@
 <img src="assets/logo.png" alt="tui-firewall" width="240">
 
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/tui-tools/tui-firewall/badge)](https://scorecard.dev/viewer/?uri=github.com/tui-tools/tui-firewall)
+
 A terminal UI for the Linux firewall — **ufw** and **firewalld** — that shows
 the rules you actually have and **previews the exact command line of every
 change before running it**.

internal/firewalld/parse_test.go

@@ -26,7 +26,7 @@ import (
 // from an assumption into a test.
 func fixture(t *testing.T, name string) string {
 	t.Helper()
-	data, err := os.ReadFile(filepath.Join("testdata", name))
+	data, err := os.ReadFile(filepath.Join("testdata", name)) //nolint:gosec // the name is a literal in the test above, and testdata is in the repository
 	if err != nil {
 		t.Fatalf("read fixture: %v", err)
 	}