fix: stop passing secrets to Upptime actions and pin them by SHA by JOY · Pull Request #6 · DOS/status

JOY (JOY) · 2026-10-24T11:36:13Z

GitHub blocked the first Uptime CI run since April with "this workflow file may be malicious".

The flag was justified:

three workflows passed toJson(secrets) to the third-party action upptime/uptime-monitor, pinned only by tag;
this public repository can read the DOS org secrets, including CLAUDE_CODE_OAUTH_TOKEN;
.upptimerc.yml uses no $SECRET placeholders, so nothing needs them.

Changes:

Remove SECRETS_CONTEXT: ${{ toJson(secrets) }} from uptime.yml, response-time.yml and setup.yml.
Pin actions/checkout, upptime/uptime-monitor, peaceiris/actions-gh-pages and benc-uk/workflow-dispatch to commit SHAs.
Declare minimal permissions per workflow:
- contents: write everywhere;
- issues: write for Uptime CI;
- actions: write for Setup CI's workflow dispatch.
Setup CI changes, so the hardening is not regenerated from the upstream template:
- its update-template step is gone;
- it now runs on master only, so feature-branch pushes no longer start it.
Update Template CI and Updates CI stay disabled, because they run upstream @master.
Raise the rate.vn slow thresholds, per the review on feat: monitor rate.vn home, health and public API #5: /api/health to 15 s, /api/v1/rate/stats to 10 s. Measured Vercel cold starts were 4-8.5 s.

Checks:

all YAML parses;
no toJson(secrets) remains;
no tag-pinned action remains in the six edited workflows.

Approved by JOY in chat on 2026-10-24. Separately, JOY may restrict the org secrets to the private repositories that need them.

🤖 Generated with Claude Code

📌 TL;DR

This PR hardens the Upptime CI workflows by pinning GitHub Actions to specific commit SHAs, removing the SECRETS_CONTEXT environment variable to prevent secret leakage, and enforcing least-privilege permissions scopes. It also adjusts the maxResponseTime thresholds in .upptimerc.yml to accommodate Vercel cold start latency.

🎯 Type of Change

🔍 Changes Walkthrough

File	Summary of Changes
`.github/workflows/graphs.yml`	Pinned `actions/checkout` and `upptime/uptime-monitor` to commit SHAs. Added `permissions: contents: write`. Removed `SECRETS_CONTEXT` env var. Updated header comments to reflect manual hardening.
`.github/workflows/response-time.yml`	Pinned actions to commit SHAs. Added `permissions: contents: write`. Removed `SECRETS_CONTEXT` env var. Updated header comments.
`.github/workflows/setup.yml`	Pinned actions to commit SHAs. Added `permissions: contents: write, actions: write`. Removed the `update-template` step to prevent overwriting hardened workflows. Removed `SECRETS_CONTEXT` env var. Restricted push trigger to `master` branch.
`.github/workflows/site.yml`	Pinned `actions/checkout`, `upptime/uptime-monitor`, and `peaceiris/actions-gh-pages` to commit SHAs. Added `permissions: contents: write`. Removed `SECRETS_CONTEXT` env var. Updated header comments.
`.github/workflows/summary.yml`	Pinned actions to commit SHAs. Added `permissions: contents: write`. Removed `SECRETS_CONTEXT` env var. Updated header comments.
`.github/workflows/uptime.yml`	Pinned actions to commit SHAs. Added `permissions: contents: write, issues: write`. Removed `SECRETS_CONTEXT` env var. Updated header comments.
`.upptimerc.yml`	Increased `maxResponseTime` for `Rate.vn Health` from 10s to 15s and `Rate.vn API` from 5s to 10s to account for Vercel cold start latency (4-8.5s).

📊 Architectural Flow

flowchart TD
    subgraph "CI Trigger"
        A[Push to master / Dispatch] --> B{Workflow Type}
    end

    subgraph "Hardened Workflows"
        B -->|Setup| C[Setup CI]
        B -->|Uptime| D[Uptime CI]
        B -->|Response Time| E[Response Time CI]
        B -->|Graphs| F[Graphs CI]
        B -->|Site| G[Static Site CI]
        B -->|Summary| H[Summary CI]
    end

    subgraph "Security Hardening"
        C & D & E & F & G & H --> I[Pinned Action SHAs]
        C & D & E & F & G & H --> J[Least Privilege Permissions]
        C & D & E & F & G & H --> K[No SECRETS_CONTEXT]
    end

    subgraph "Upptime Execution"
        I & J & K --> L[upptime/uptime-monitor]
        L --> M[Update Status / Generate Assets]
    end

    subgraph "Deployment"
        M --> N[GitHub Pages / README]
    end

@master

GitHub flagged Uptime CI as possibly malicious and blocked it: three workflows passed `toJson(secrets)` to a third-party action, and this public repository can read the DOS org secrets, including CLAUDE_CODE_OAUTH_TOKEN. The site config uses no secret placeholders, so nothing needs them. - Remove SECRETS_CONTEXT from uptime, response-time and setup. - Pin actions/checkout, upptime/uptime-monitor, peaceiris/actions-gh-pages and benc-uk/workflow-dispatch to commit SHAs. - Give each workflow only the token permissions it needs. - Drop the update-template step from Setup CI and run it on master only, so the hardening is not regenerated away. Update Template CI and Updates CI (which run upstream @master) stay disabled. - Raise the rate.vn slow thresholds (health 15 s, API 10 s) for Vercel cold starts, per review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

coderabbitai · 2026-10-24T11:36:24Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 7e647fb3-dfb0-40f4-8d07-a8604972d2d7

Commits

Reviewing files that changed from the base of the PR and between 7f6bef8 and ebbfecb.

Files selected for processing: 7

.github/workflows/graphs.yml
.github/workflows/response-time.yml
.github/workflows/setup.yml
.github/workflows/site.yml
.github/workflows/summary.yml
.github/workflows/uptime.yml
.upptimerc.yml

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist

Code Review

This pull request updates the .upptimerc.yml configuration file to increase the maxResponseTime thresholds for the 'Rate.vn Health' and 'Rate.vn API' sites to 15000 ms and 10000 ms, respectively, to accommodate Vercel cold starts. I have no feedback to provide.

dos

⏱️ Code Review completed (7 eligible files · 13,983 chars · 1 model call(s) · 1 PR unit(s))

Whole diff with bounded context at base 7f6bef8 / head 1e1611a.

✅ CLEAN_PASS: Complete diff reviewed

gemini-code-assist

Code Review

This pull request updates the Upptime configuration in .upptimerc.yml by increasing the maxResponseTime thresholds for the 'Rate.vn Health' and 'Rate.vn API' sites to 15000 ms and 10000 ms respectively, to accommodate Vercel cold starts. The accompanying comment was also updated to explain this change. There are no review comments to address, and I have no additional feedback to provide.

Both run the same status update as Uptime CI, which opens, comments on and closes incident issues after committing history. Without issues: write a status change seen by these runs would be committed but never reported. Review finding on #6. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

JOY (JOY) · 2026-10-24T11:45:20Z

Review record. An independent subagent reviewer checked head 1e1611a.

What it verified:

all four pinned SHAs match their tags;
removing SECRETS_CONTEXT is safe: uptime-monitor falls back to {};
the setup.yml changes are fine;
no secret exposure or injection path remains;
the YAML is valid.

It also found that the repo's default token permission is read. That is why every scheduled run since June failed, and why the explicit permissions blocks are required.

One P2 finding: response-time.yml and setup.yml need issues: write, because they run the same status update that opens and closes incident issues. Fixed in ebbfecb, the exact change the review proposed.

P3 notes, accepted with no change:

The GH_PAT || github.token fallback: no GH_PAT exists today.
Runtime npm i of @upptime/status-page and @upptime/graphs is unpinned. This predates the PR.
update-template.yml and updates.yml stay disabled. Deleting them later is worth considering.

dos

⏱️ Code Review completed (7 eligible files · 14,017 chars · 1 model call(s) · 1 PR unit(s))

Whole diff with bounded context at base 7f6bef8 / head ebbfecb.

✅ CLEAN_PASS: Complete diff reviewed

claude Bot reviewed Oct 24, 2026

View reviewed changes

gemini-code-assist Bot reviewed Oct 24, 2026

View reviewed changes

dos Bot approved these changes Oct 24, 2026

View reviewed changes

gemini-code-assist Bot reviewed Oct 24, 2026

View reviewed changes

dos Bot approved these changes Oct 24, 2026

View reviewed changes

JOY (JOY) merged commit 399c8c7 into master Oct 24, 2026
6 checks passed

Navigation Menu

Repository navigation

fix: stop passing secrets to Upptime actions and pin them by SHA - #6

fix: stop passing secrets to Upptime actions and pin them by SHA#6
JOY (JOY) merged 2 commits into
masterfrom
claude/harden-upptime-workflows

JOY (JOY) commented Oct 24, 2026 •

edited by dos Bot

Loading

Uh oh!

claude Bot left a comment

Uh oh!

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading

Review limit reached

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

dos Bot left a comment

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

JOY (JOY) commented Oct 24, 2026

Uh oh!

dos Bot left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

JOY (JOY) commented Oct 24, 2026 • edited by dos Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📌 TL;DR

🎯 Type of Change

🔍 Changes Walkthrough

📊 Architectural Flow

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

dos Bot left a comment

Choose a reason for hiding this comment

✅ CLEAN_PASS: Complete diff reviewed

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

JOY (JOY) commented Oct 24, 2026

Uh oh!

dos Bot left a comment

Choose a reason for hiding this comment

✅ CLEAN_PASS: Complete diff reviewed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

JOY (JOY) commented Oct 24, 2026 •

edited by dos Bot

Loading

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading