[WIP] feat(security): add checksum validation infrastructure

.github/workflows/README.md

@@ -114,11 +114,6 @@ All workflows in this repository follow security best practices:
 * Secrets inherited explicitly with `secrets: inherit`
 * No hardcoded tokens or credentials
 
-### Network Hardening
-
-* `step-security/harden-runner` used in all jobs for egress policy auditing
-* Egress policy set to `audit` mode for visibility
-
 ## Maintenance
 
 ### Updating SHA Pins
@@ -252,7 +247,7 @@ To add a new workflow to the repository:
 
 1. Create `{tool-name}.yml` following existing patterns
 2. Implement 4-channel result publishing (annotations, artifacts, SARIF if security, summaries)
-3. Add harden-runner and SHA pinning
+3. Use SHA pinning for all actions
 4. Use minimal permissions
 5. Add soft-fail input support
 6. Update `pr-validation.yml` and `main.yml` to include new job
@@ -487,7 +482,6 @@ permissions:
 
 * All actions MUST be pinned to SHA commits (not tags or branches)
 * Include SHA comment showing the tag/version (e.g., `# v4.2.2`)
-* Use Harden Runner for audit logging
 * Disable credential persistence when checking out code: `persist-credentials: false`
 
 ## Troubleshooting

.github/workflows/dependency-pinning-scan.yml

@@ -55,11 +55,6 @@ jobs:
       unpinned-count: ${{ steps.pinning.outputs.unpinned-count }}
       is-compliant: ${{ steps.pinning.outputs.is-compliant }}
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@92c522aaa6f53af082553dedc1596c80b71aba33 # v2.10.2
-        with:
-          egress-policy: audit
-
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
         with:

.github/workflows/frontmatter-validation.yml

@@ -34,11 +34,6 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
-        with:
-          egress-policy: audit
-
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
         with:

.github/workflows/link-lang-check.yml

@@ -19,11 +19,6 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
-        with:
-          egress-policy: audit
-
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
         with:

.github/workflows/markdown-link-check.yml

@@ -19,11 +19,6 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
-        with:
-          egress-policy: audit
-
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
         with:

.github/workflows/markdown-lint.yml

@@ -20,11 +20,6 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
-        with:
-          egress-policy: audit
-
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
         with:

.github/workflows/pr-validation.yml

@@ -83,3 +83,26 @@ jobs:
       soft-fail: false
       upload-sarif: true
       upload-artifact: false
+
+  npm-audit:
+    name: npm Security Audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@633bb92bc0aabcae06e8ea93b85aecddd374c402 # v4.1.0
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run security audit
+        run: npm audit --audit-level=moderate

.github/workflows/ps-script-analyzer.yml

@@ -24,11 +24,6 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
-        with:
-          egress-policy: audit
-
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
         with:

.github/workflows/sha-staleness-check.yml

@@ -36,11 +36,6 @@ jobs:
       stale-count: ${{ steps.staleness.outputs.stale-count }}
       has-stale: ${{ steps.staleness.outputs.has-stale }}
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@92c522aaa6f53af082553dedc1596c80b71aba33 # v2.10.2
-        with:
-          egress-policy: audit
-
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
         with:

.github/workflows/spell-check.yml

@@ -20,11 +20,6 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
-        with:
-          egress-policy: audit
-
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
         with:

.github/workflows/table-format.yml

@@ -20,11 +20,6 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.10.2
-        with:
-          egress-policy: audit
-
       - name: Checkout code
         uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4.2.2
         with:

scripts/lib/Get-VerifiedDownload.ps1

@@ -0,0 +1,86 @@
+<#
+.SYNOPSIS
+    Downloads and verifies artifacts using SHA256 checksums.
+
+.DESCRIPTION
+    Securely downloads files from URLs and verifies their integrity using
+    SHA256 checksums before saving or extracting.
+
+.PARAMETER Url
+    URL to download from.
+
+.PARAMETER ExpectedSHA256
+    Expected SHA256 checksum of the file.
+
+.PARAMETER OutputPath
+    Path where the downloaded file will be saved.
+
+.PARAMETER Extract
+    Extract the archive after verification.
+
+.PARAMETER ExtractPath
+    Destination directory for extraction.
+
+.EXAMPLE
+    Get-VerifiedDownload -Url "https://example.com/tool.tar.gz" -ExpectedSHA256 "abc123..." -OutputPath "./tool.tar.gz"
+
+.EXAMPLE
+    Get-VerifiedDownload -Url "https://example.com/tool.tar.gz" -ExpectedSHA256 "abc123..." -OutputPath "./tool.tar.gz" -Extract -ExtractPath "./tools"
+#>
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$Url,
+
+    [Parameter(Mandatory = $true)]
+    [string]$ExpectedSHA256,
+
+    [Parameter(Mandatory = $true)]
+    [string]$OutputPath,
+
+    [Parameter(Mandatory = $false)]
+    [switch]$Extract,
+
+    [Parameter(Mandatory = $false)]
+    [string]$ExtractPath
+)
+
+$ErrorActionPreference = 'Stop'
+
+$tempFile = [System.IO.Path]::GetTempFileName()
+
+try {
+    Write-Host "Downloading: $Url"
+    Invoke-WebRequest -Uri $Url -OutFile $tempFile -UseBasicParsing
+
+    Write-Host "Verifying SHA256: $ExpectedSHA256"
+    $actualHash = (Get-FileHash -Path $tempFile -Algorithm SHA256).Hash
+
+    if ($actualHash -ne $ExpectedSHA256.ToUpper()) {
+        Write-Error "Checksum verification failed!`nExpected: $ExpectedSHA256`nActual:   $actualHash"
+        exit 1
+    }
+
+    if ($Extract -and $ExtractPath) {
+        Write-Host "Extracting to: $ExtractPath"
+        if (-not (Test-Path $ExtractPath)) {
+            New-Item -ItemType Directory -Path $ExtractPath -Force | Out-Null
+        }
+        Expand-Archive -Path $tempFile -DestinationPath $ExtractPath -Force
+    }
+    else {
+        $outputDir = Split-Path -Parent $OutputPath
+        if ($outputDir -and -not (Test-Path $outputDir)) {
+            New-Item -ItemType Directory -Path $outputDir -Force | Out-Null
+        }
+        Move-Item -Path $tempFile -Destination $OutputPath -Force
+    }
+
+    Write-Host "Download verified and complete" -ForegroundColor Green
+}
+finally {
+    if (Test-Path $tempFile) {
+        Remove-Item -Path $tempFile -Force -ErrorAction SilentlyContinue
+    }
+}

scripts/security/Test-DependencyPinning.ps1

@@ -143,7 +143,7 @@ $DependencyPatterns = @{
         RemediationUrl  = 'https://registry.npmjs.org/{0}/{1}'
     }
 
-    'pip'            = @{
+    'pip'              = @{
         FilePatterns    = @('**/requirements*.txt', '**/Pipfile', '**/pyproject.toml', '**/setup.py')
         VersionPatterns = @(
             @{
@@ -155,6 +155,13 @@ $DependencyPatterns = @{
         SHAPattern      = '^[a-fA-F0-9]{40}$'
         RemediationUrl  = 'https://pypi.org/pypi/{0}/{1}/json'
     }
+
+    'shell-downloads'  = @{
+        FilePatterns   = @('*.sh')
+        SearchPaths    = @('.devcontainer/scripts', 'scripts')
+        ValidationFunc = 'Test-ShellDownloadSecurity'
+        Description    = 'Shell script downloads must include checksum verification'
+    }
 }
 
 class DependencyViolation {
@@ -195,6 +202,66 @@ class ComplianceReport {
     }
 }
 
+function Test-ShellDownloadSecurity {
+    <#
+    .SYNOPSIS
+        Scans shell scripts for curl/wget downloads lacking checksum verification.
+
+    .DESCRIPTION
+        Analyzes shell scripts to detect download commands (curl/wget) that do not
+        have corresponding checksum verification (sha256sum/shasum) within the
+        following lines.
+
+    .PARAMETER FilePath
+        Path to the shell script file to scan.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]
+        [string]$FilePath
+    )
+
+    if (-not (Test-Path $FilePath)) {
+        return @()
+    }
+
+    $lines = Get-Content $FilePath
+    $violations = @()
+
+    # Pattern to match curl/wget download commands
+    $downloadPattern = '(curl|wget)\s+.*https?://[^\s]+'
+    $checksumPattern = 'sha256sum|shasum'
+
+    for ($i = 0; $i -lt $lines.Count; $i++) {
+        $line = $lines[$i]
+        if ($line -match $downloadPattern) {
+            # Check next 5 lines for checksum verification
+            $hasChecksum = $false
+            $searchEnd = [Math]::Min($i + 5, $lines.Count - 1)
+
+            for ($j = $i; $j -le $searchEnd; $j++) {
+                if ($lines[$j] -match $checksumPattern) {
+                    $hasChecksum = $true
+                    break
+                }
+            }
+
+            if (-not $hasChecksum) {
+                $violations += [PSCustomObject]@{
+                    File      = $FilePath
+                    Line      = $i + 1
+                    Pattern   = $line.Trim()
+                    Issue     = 'Download without checksum verification'
+                    Severity  = 'warning'
+                    Ecosystem = 'shell-downloads'
+                }
+            }
+        }
+    }
+
+    return $violations
+}
+
 function Write-PinningLog {
     param(
         [Parameter(Mandatory = $true)]