From 1e1611aac0fd20c800399f60c58f749831705006 Mon Sep 17 00:00:00 2001 From: JOY <5027251+JOY@users.noreply.github.com> Date: Sat, 24 Oct 2026 18:35:57 +0700 Subject: [PATCH 1/2] fix: stop passing secrets to Upptime actions and pin them by SHA GitHub flagged Uptime CI as possibly malicious and blocked it: three workflows passed `toJson(secrets)` to a third-party action, and this public repository can read the DOS org secrets, including CLAUDE_CODE_OAUTH_TOKEN. The site config uses no secret placeholders, so nothing needs them. - Remove SECRETS_CONTEXT from uptime, response-time and setup. - Pin actions/checkout, upptime/uptime-monitor, peaceiris/actions-gh-pages and benc-uk/workflow-dispatch to commit SHAs. - Give each workflow only the token permissions it needs. - Drop the update-template step from Setup CI and run it on master only, so the hardening is not regenerated away. Update Template CI and Updates CI (which run upstream @master) stay disabled. - Raise the rate.vn slow thresholds (health 15 s, API 10 s) for Vercel cold starts, per review. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/graphs.yml | 24 +++++++---------- .github/workflows/response-time.yml | 25 +++++++---------- .github/workflows/setup.yml | 42 +++++++++++------------------ .github/workflows/site.yml | 26 +++++++----------- .github/workflows/summary.yml | 24 +++++++---------- .github/workflows/uptime.yml | 26 +++++++----------- .upptimerc.yml | 7 ++--- 7 files changed, 67 insertions(+), 107 deletions(-) diff --git a/.github/workflows/graphs.yml b/.github/workflows/graphs.yml index 66fba8ed9..3efd6729a 100644 --- a/.github/workflows/graphs.yml +++ b/.github/workflows/graphs.yml @@ -1,18 +1,10 @@ # -# =============================== -# Do not edit this file directly! -# =============================== +# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then +# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are +# passed to them, and the token gets only the permissions it needs. +# Update Template CI and the template step of Setup CI are off, so these +# edits are not overwritten. Change sites in .upptimerc.yml as usual. # -# Your changes will be overwritten when the Upptime template updates (by default, weekly) -# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly. -# -# 🔼 Upptime @v1.41.0 -# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary - -# * Source: https://github.com/upptime/upptime -# * Docs and more: https://upptime.js.org -# * More by Anand Chowdhary: https://anandchowdhary.com - name: Graphs CI on: @@ -21,18 +13,20 @@ on: repository_dispatch: types: [graphs] workflow_dispatch: +permissions: + contents: write jobs: release: name: Generate graphs runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.head_ref }} token: ${{ secrets.GH_PAT || github.token }} - name: Generate graphs - uses: upptime/uptime-monitor@v1.41.0 + uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0 with: command: "graphs" env: diff --git a/.github/workflows/response-time.yml b/.github/workflows/response-time.yml index 8427aa61e..7082a68d2 100644 --- a/.github/workflows/response-time.yml +++ b/.github/workflows/response-time.yml @@ -1,18 +1,10 @@ # -# =============================== -# Do not edit this file directly! -# =============================== +# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then +# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are +# passed to them, and the token gets only the permissions it needs. +# Update Template CI and the template step of Setup CI are off, so these +# edits are not overwritten. Change sites in .upptimerc.yml as usual. # -# Your changes will be overwritten when the Upptime template updates (by default, weekly) -# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly. -# -# 🔼 Upptime @v1.41.0 -# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary - -# * Source: https://github.com/upptime/upptime -# * Docs and more: https://upptime.js.org -# * More by Anand Chowdhary: https://anandchowdhary.com - name: Response Time CI on: @@ -21,20 +13,21 @@ on: repository_dispatch: types: [response_time] workflow_dispatch: +permissions: + contents: write jobs: release: name: Check status runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.head_ref }} token: ${{ secrets.GH_PAT || github.token }} - name: Update response time - uses: upptime/uptime-monitor@v1.41.0 + uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0 with: command: "response-time" env: GH_PAT: ${{ secrets.GH_PAT || github.token }} - SECRETS_CONTEXT: ${{ toJson(secrets) }} diff --git a/.github/workflows/setup.yml b/.github/workflows/setup.yml index 237ebdf36..b06554b64 100644 --- a/.github/workflows/setup.yml +++ b/.github/workflows/setup.yml @@ -1,68 +1,58 @@ # -# =============================== -# Do not edit this file directly! -# =============================== +# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then +# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are +# passed to them, and the token gets only the permissions it needs. +# The "update-template" step is removed: it regenerated these workflows from +# the upstream template and would undo the hardening. Change sites in +# .upptimerc.yml as usual; this workflow then refreshes the README and site. # -# Your changes will be overwritten when the Upptime template updates (by default, weekly) -# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly. -# -# 🔼 Upptime @v1.41.0 -# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary - -# * Source: https://github.com/upptime/upptime -# * Docs and more: https://upptime.js.org -# * More by Anand Chowdhary: https://anandchowdhary.com - name: Setup CI on: push: + branches: [master] paths: - ".upptimerc.yml" repository_dispatch: types: [setup] workflow_dispatch: +permissions: + contents: write + actions: write jobs: release: name: Setup Upptime runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.head_ref }} token: ${{ secrets.GH_PAT || github.token }} - - name: Update template - uses: upptime/uptime-monitor@v1.41.0 - with: - command: "update-template" - env: - GH_PAT: ${{ secrets.GH_PAT || github.token }} - name: Update response time - uses: upptime/uptime-monitor@v1.41.0 + uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0 with: command: "response-time" env: GH_PAT: ${{ secrets.GH_PAT || github.token }} - SECRETS_CONTEXT: ${{ toJson(secrets) }} - name: Update summary in README - uses: upptime/uptime-monitor@v1.41.0 + uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0 with: command: "readme" env: GH_PAT: ${{ secrets.GH_PAT || github.token }} - name: Generate graphs - uses: benc-uk/workflow-dispatch@v1 + uses: benc-uk/workflow-dispatch@d004979be141727c7a17c28f603e2facc40d0855 # v1 with: workflow: Graphs CI token: ${{ secrets.GH_PAT || github.token }} - name: Generate site - uses: upptime/uptime-monitor@v1.41.0 + uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0 with: command: "site" env: GH_PAT: ${{ secrets.GH_PAT || github.token }} - - uses: peaceiris/actions-gh-pages@v4 + - uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4 name: GitHub Pages Deploy with: github_token: ${{ secrets.GH_PAT || github.token }} diff --git a/.github/workflows/site.yml b/.github/workflows/site.yml index ed220474e..b08f884ca 100644 --- a/.github/workflows/site.yml +++ b/.github/workflows/site.yml @@ -1,18 +1,10 @@ # -# =============================== -# Do not edit this file directly! -# =============================== +# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then +# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are +# passed to them, and the token gets only the permissions it needs. +# Update Template CI and the template step of Setup CI are off, so these +# edits are not overwritten. Change sites in .upptimerc.yml as usual. # -# Your changes will be overwritten when the Upptime template updates (by default, weekly) -# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly. -# -# 🔼 Upptime @v1.41.0 -# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary - -# * Source: https://github.com/upptime/upptime -# * Docs and more: https://upptime.js.org -# * More by Anand Chowdhary: https://anandchowdhary.com - name: Static Site CI on: @@ -21,6 +13,8 @@ on: repository_dispatch: types: [static_site] workflow_dispatch: +permissions: + contents: write jobs: release: name: Build and deploy site @@ -28,17 +22,17 @@ jobs: if: "!contains(github.event.head_commit.message, '[skip ci]')" steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.head_ref }} token: ${{ secrets.GH_PAT || github.token }} - name: Generate site - uses: upptime/uptime-monitor@v1.41.0 + uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0 with: command: "site" env: GH_PAT: ${{ secrets.GH_PAT || github.token }} - - uses: peaceiris/actions-gh-pages@v4 + - uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4 name: GitHub Pages Deploy with: github_token: ${{ secrets.GH_PAT || github.token }} diff --git a/.github/workflows/summary.yml b/.github/workflows/summary.yml index 59185cc96..fa2d72ae2 100644 --- a/.github/workflows/summary.yml +++ b/.github/workflows/summary.yml @@ -1,18 +1,10 @@ # -# =============================== -# Do not edit this file directly! -# =============================== +# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then +# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are +# passed to them, and the token gets only the permissions it needs. +# Update Template CI and the template step of Setup CI are off, so these +# edits are not overwritten. Change sites in .upptimerc.yml as usual. # -# Your changes will be overwritten when the Upptime template updates (by default, weekly) -# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly. -# -# 🔼 Upptime @v1.41.0 -# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary - -# * Source: https://github.com/upptime/upptime -# * Docs and more: https://upptime.js.org -# * More by Anand Chowdhary: https://anandchowdhary.com - name: Summary CI on: @@ -21,18 +13,20 @@ on: repository_dispatch: types: [summary] workflow_dispatch: +permissions: + contents: write jobs: release: name: Generate README runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.head_ref }} token: ${{ secrets.GH_PAT || github.token }} - name: Update summary in README - uses: upptime/uptime-monitor@v1.41.0 + uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0 with: command: "readme" env: diff --git a/.github/workflows/uptime.yml b/.github/workflows/uptime.yml index 4773d0cad..5172689d1 100644 --- a/.github/workflows/uptime.yml +++ b/.github/workflows/uptime.yml @@ -1,18 +1,10 @@ # -# =============================== -# Do not edit this file directly! -# =============================== +# Generated by Upptime v1.41.0 (https://github.com/upptime/upptime), then +# hardened on 2026-10-24: actions are pinned to commit SHAs, no secrets are +# passed to them, and the token gets only the permissions it needs. +# Update Template CI and the template step of Setup CI are off, so these +# edits are not overwritten. Change sites in .upptimerc.yml as usual. # -# Your changes will be overwritten when the Upptime template updates (by default, weekly) -# Instead, change .upptimerc.yml configuration and the workflows will be generated accordingly. -# -# 🔼 Upptime @v1.41.0 -# GitHub-powered open-source uptime monitor and status page by Anand Chowdhary - -# * Source: https://github.com/upptime/upptime -# * Docs and more: https://upptime.js.org -# * More by Anand Chowdhary: https://anandchowdhary.com - name: Uptime CI on: @@ -21,20 +13,22 @@ on: repository_dispatch: types: [uptime] workflow_dispatch: +permissions: + contents: write + issues: write jobs: release: name: Check status runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.head_ref }} token: ${{ secrets.GH_PAT || github.token }} - name: Check endpoint status - uses: upptime/uptime-monitor@v1.41.0 + uses: upptime/uptime-monitor@e620a0d7a97526a295bbe3970495bff6495bdf27 # v1.41.0 with: command: "update" env: GH_PAT: ${{ secrets.GH_PAT || github.token }} - SECRETS_CONTEXT: ${{ toJson(secrets) }} diff --git a/.upptimerc.yml b/.upptimerc.yml index 2f7562d1f..ef2cf2fb6 100644 --- a/.upptimerc.yml +++ b/.upptimerc.yml @@ -47,16 +47,17 @@ sites: icon: https://rate.vn/img/rate-logo-64.png maxResponseTime: 5000 - # 503 when the Supabase read fails (DOS/Rate#829). Cold starts take up to ~9 s. + # 503 when the Supabase read fails (DOS/Rate#829). Vercel cold starts took + # 4-8.5 s when measured, so the slow threshold leaves headroom. - name: Rate.vn Health url: https://rate.vn/api/health icon: https://rate.vn/img/rate-logo-64.png - maxResponseTime: 10000 + maxResponseTime: 15000 - name: Rate.vn API url: https://rate.vn/api/v1/rate/stats icon: https://rate.vn/img/rate-logo-64.png - maxResponseTime: 5000 + maxResponseTime: 10000 status-website: cname: status.dos.ai From ebbfecbb5408d4989369b3a3f053400529f6ade4 Mon Sep 17 00:00:00 2001 From: JOY <5027251+JOY@users.noreply.github.com> Date: Sat, 24 Oct 2026 18:45:04 +0700 Subject: [PATCH 2/2] fix: let response-time and setup runs open and close incident issues Both run the same status update as Uptime CI, which opens, comments on and closes incident issues after committing history. Without issues: write a status change seen by these runs would be committed but never reported. Review finding on #6. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/response-time.yml | 1 + .github/workflows/setup.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/response-time.yml b/.github/workflows/response-time.yml index 7082a68d2..2d91ce0f2 100644 --- a/.github/workflows/response-time.yml +++ b/.github/workflows/response-time.yml @@ -15,6 +15,7 @@ on: workflow_dispatch: permissions: contents: write + issues: write jobs: release: name: Check status diff --git a/.github/workflows/setup.yml b/.github/workflows/setup.yml index b06554b64..b309cfca6 100644 --- a/.github/workflows/setup.yml +++ b/.github/workflows/setup.yml @@ -19,6 +19,7 @@ on: permissions: contents: write actions: write + issues: write jobs: release: name: Setup Upptime