@opengroundplan/core 0.1.1

package/templates/layers/security-supply-chain/blueprint.yaml

@@ -0,0 +1,208 @@
+# Supply-chain hardening for a GitHub-hosted repo: dependency updates with a release-age
+# cooldown, CodeQL (including the repo's own workflows), secret scanning in CI and at commit
+# time, CycloneDX + SPDX SBOMs, and every action pinned by commit SHA.
+#
+# Derived from docs/research/03 §4.5 and §5.4. The four 2025 postinstall worms and
+# CVE-2025-30066 are why the defaults look paranoid.
+#
+# Paths under `files/` mirror the generated repo — plan.ts strips only the leading `files/`
+# segment, so `files/.github/workflows/codeql.yml` lands at `.github/workflows/codeql.yml`.
+id: security-supply-chain
+kind: layer
+name: Supply-chain security
+description: >-
+  Dependabot or Renovate with a cooldown, CodeQL with `language: actions`, gitleaks in CI and
+  as a pre-commit hook, CycloneDX + SPDX SBOMs, OpenSSF Scorecard, dependency review, and
+  SHA-pinned actions. OWASP moved supply-chain failures to A03:2025; this is the baseline.
+
+tags:
+  - security
+  - supply-chain
+  - dependabot
+  - renovate
+  - codeql
+  - sast
+  - secret-scanning
+  - gitleaks
+  - sbom
+  - cyclonedx
+  - spdx
+  - scorecard
+  - slsa
+
+# Nothing to require. Every file is repo-level metadata or CI configuration — it reads no
+# application code and imports no module, so it composes with any base and any other layer.
+requires: []
+
+# Nothing to conflict with. No base or layer currently writes `.github/`, `.npmrc`,
+# `.gitleaks.toml`, `.githooks/`, `SECURITY.md` or `renovate.json`, and the one doc file is
+# namespaced (`docs/security-supply-chain.md`) so it cannot collide with agent-kit docs.
+# A future CI layer owning `.github/workflows/ci.yml` still does not collide: every workflow
+# here has a distinct filename.
+conflicts: []
+
+# Capability names other blueprints key off instead of naming this layer directly.
+provides:
+  - supply-chain-security
+  - dependency-updates
+  - dependency-review
+  - sast
+  - code-scanning
+  - secret-scanning
+  - sbom
+  - scorecard
+  - pinned-actions
+  - security-policy
+
+# Repo metadata and CI constrain no folder layout, so every architecture overlay is fine.
+supportsArchitectures: []
+
+variables:
+  - name: securityBot
+    prompt: Which dependency update bot? (running both produces duplicate PRs)
+    type: select
+    default: dependabot
+    required: false
+    choices:
+      - { value: dependabot, label: 'Dependabot — native, no app install, SHA-pin aware' }
+      - { value: renovate, label: 'Renovate — more configurable, needs the GitHub App' }
+
+  # Dependabot needs the ecosystem named explicitly; Renovate autodetects it.
+  - name: depEcosystem
+    prompt: Dependabot package ecosystem for this repo
+    type: select
+    default: npm
+    required: false
+    when: "securityBot == 'dependabot'"
+    choices:
+      - { value: npm, label: 'npm — also covers pnpm and yarn lockfiles' }
+      - { value: uv, label: 'uv — pyproject.toml + uv.lock' }
+      - { value: pip, label: 'pip — requirements.txt or poetry' }
+      - { value: gomod, label: 'gomod — go.mod' }
+      - { value: nuget, label: 'nuget — .csproj / Directory.Packages.props' }
+      - { value: cargo, label: 'cargo — Cargo.toml' }
+      - { value: maven, label: 'maven — pom.xml' }
+
+  # The direct answer to Shai-Hulud: a poisoned release is normally yanked within days.
+  # Applies to version updates only — security updates are exempt by design.
+  - name: depCooldownDays
+    prompt: Days to hold a new version before opening an update PR
+    type: number
+    default: 7
+    required: false
+
+  # `actions` belongs in every matrix: it is what catches script injection in this repo's
+  # own workflows. build-mode `none` everywhere except Go, which needs a real build.
+  - name: codeqlMatrix
+    prompt: CodeQL languages to analyse
+    type: select
+    default: '[{ language: actions, buildMode: none }, { language: javascript-typescript, buildMode: none }]'
+    required: false
+    choices:
+      - value: '[{ language: actions, buildMode: none }, { language: javascript-typescript, buildMode: none }]'
+        label: 'JavaScript / TypeScript'
+      - value: '[{ language: actions, buildMode: none }, { language: python, buildMode: none }]'
+        label: 'Python'
+      - value: '[{ language: actions, buildMode: none }, { language: go, buildMode: autobuild }]'
+        label: 'Go'
+      - value: '[{ language: actions, buildMode: none }, { language: csharp, buildMode: none }]'
+        label: 'C# / .NET'
+      - value: '[{ language: actions, buildMode: none }, { language: java-kotlin, buildMode: none }]'
+        label: 'Java / Kotlin'
+      - value: '[{ language: actions, buildMode: none }, { language: rust, buildMode: none }]'
+        label: 'Rust'
+      - value: '[{ language: actions, buildMode: none }, { language: javascript-typescript, buildMode: none }, { language: python, buildMode: none }]'
+        label: 'Polyglot — TypeScript + Python'
+      - value: '[{ language: actions, buildMode: none }]'
+        label: 'Workflows only — add languages later'
+
+  - name: securityScanCron
+    prompt: Cron for the scheduled security scans (CodeQL, Scorecard, secrets, SBOM)
+    type: string
+    default: 0 3 * * 1
+    required: false
+
+  # `audit` records egress and never breaks a build; `block` enforces an allowlist and needs
+  # the audit run first to know what to allow.
+  - name: hardenRunnerEgress
+    prompt: harden-runner network egress policy
+    type: select
+    default: audit
+    required: false
+    choices:
+      - { value: audit, label: 'audit — log outbound calls (start here)' }
+      - { value: block, label: 'block — deny anything not allowlisted' }
+
+  - name: dependencyReviewSeverity
+    prompt: Fail a PR when a newly added dependency has a vulnerability at or above
+    type: select
+    default: high
+    required: false
+    choices:
+      - { value: critical, label: critical }
+      - { value: high, label: high }
+      - { value: moderate, label: moderate }
+      - { value: low, label: low }
+
+  # Pinned rather than `latest`: a scanner that silently changes behaviour between runs is
+  # a scanner nobody trusts. Downloaded with checksum verification in CI.
+  - name: gitleaksVersion
+    prompt: gitleaks version
+    type: string
+    default: 8.30.1
+    required: false
+
+  - name: syftVersion
+    prompt: Syft version used to generate the SBOMs
+    type: string
+    default: 1.48.0
+    required: false
+
+  - name: securityContact
+    prompt: Email for vulnerability reports (GitHub private reporting is offered first)
+    type: string
+    default: security@example.com
+    required: false
+
+  - name: securityResponseDays
+    prompt: Business days to acknowledge a vulnerability report
+    type: number
+    default: 5
+    required: false
+
+files:
+  # ── every stack ─────────────────────────────────────────────────────────────
+  - from: files/.github/workflows/codeql.yml
+  - from: files/.github/workflows/scorecard.yml
+  - from: files/.github/workflows/secret-scan.yml
+  - from: files/.github/workflows/sbom.yml
+  - from: files/.github/workflows/dependency-review.yml
+  - from: files/.gitleaks.toml
+  - from: files/.githooks/pre-commit
+  - from: files/SECURITY.md
+  - from: files/docs/security-supply-chain.md
+
+  # ── one bot, never both ─────────────────────────────────────────────────────
+  # ci-github-actions ships a dependabot.yml covering github-actions only, and invites the
+  # reader to add their language ecosystem by hand. This one already covers both plus
+  # cooldown, so it supersedes rather than collides — without this the two layers together
+  # are ungeneratable.
+  - from: files/.github/dependabot.yml
+    when: "securityBot == 'dependabot'"
+    onConflict: overwrite
+  - from: files/renovate.json
+    when: "securityBot == 'renovate'"
+
+  # ── node / typescript ───────────────────────────────────────────────────────
+  # `ignore-scripts=true` is the only control here that prevents rather than detects.
+  # pnpm 10+ already blocks dependency scripts, so a pnpm-only repo loses nothing.
+  - from: files/npmrc
+    when: "stack == 'typescript' || stack == 'node'"
+
+postApply:
+  # The hook is inert until git is told where to look. Optional: the target may not be a
+  # git repo yet, and a missing hook must never fail generation.
+  - run: git config core.hooksPath .githooks
+    optional: true
+  - run: chmod +x .githooks/pre-commit
+    optional: true

package/templates/layers/security-supply-chain/files/.githooks/pre-commit

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Secret scanning only. Hooks that also lint, format and test get disabled within a week,
+# and a disabled hook scans nothing.
+#
+# Enable once per clone:  git config core.hooksPath .githooks
+# Bypass a false positive: SKIP_SECRET_SCAN=1 git commit ...
+set -eu
+
+[ "${SKIP_SECRET_SCAN:-0}" = "1" ] && exit 0
+
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo "pre-commit: gitleaks is not installed — staged changes were NOT scanned." >&2
+  echo "            https://github.com/gitleaks/gitleaks#installing" >&2
+  exit 0
+fi
+
+exec gitleaks git --pre-commit --staged --redact=100 --no-banner --config .gitleaks.toml

package/templates/layers/security-supply-chain/files/.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+
+updates:
+  # Actions first: this repo pins every `uses:` by SHA, and Dependabot is the only thing
+  # that bumps a pin. It reads the version from the `# vX.Y.Z` comment beside the SHA —
+  # delete the comment and updates stop silently.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: {{ depCooldownDays }}
+    groups:
+      github-actions:
+        patterns: ['*']
+
+  - package-ecosystem: {{ depEcosystem }}
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    # A poisoned release is usually yanked within days. Cooldown delays *version* PRs long
+    # enough for that to happen; security updates are exempt and still arrive immediately.
+    cooldown:
+      default-days: {{ depCooldownDays }}
+    groups:
+      # One PR for the safe bulk, individual PRs for majors that need a human to read them.
+      minor-and-patch:
+        patterns: ['*']
+        update-types: [minor, patch]

package/templates/layers/security-supply-chain/files/.github/workflows/codeql.yml

@@ -0,0 +1,54 @@
+# CodeQL static analysis. `actions` is in every matrix on purpose — it catches script
+# injection in this repo's own workflows, which is how tj-actions and Nx were both reached.
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '{{ securityScanCron }}'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    # Free on public repos. Private repos need GitHub Code Security; until it is enabled
+    # this self-disables instead of failing every PR. Opt in with repo variable
+    # ENABLE_CODE_SCANNING=true.
+    if: github.repository_visibility == 'public' || vars.ENABLE_CODE_SCANNING == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+      packages: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include: {{ codeqlMatrix }}
+    steps:
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: '{{ hardenRunnerEgress }}'
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.buildMode }}
+          queries: security-extended
+
+      - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          category: /language:${{ matrix.language }}

package/templates/layers/security-supply-chain/files/.github/workflows/dependency-review.yml

@@ -0,0 +1,35 @@
+# Blocks a PR that introduces a known-vulnerable or badly-licensed dependency, before
+# the merge rather than after the next scheduled scan.
+name: Dependency Review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  review:
+    # Needs the dependency graph: on by default for public repos, part of GitHub Code
+    # Security for private ones. Opt in with repo variable ENABLE_CODE_SCANNING=true.
+    if: github.repository_visibility == 'public' || vars.ENABLE_CODE_SCANNING == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: '{{ hardenRunnerEgress }}'
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          # Gates only on newly introduced dependencies, so the threshold can stay strict
+          # without the pre-existing-CVE noise that trains people to bypass it.
+          fail-on-severity: '{{ dependencyReviewSeverity }}'
+          comment-summary-in-pr: on-failure

package/templates/layers/security-supply-chain/files/.github/workflows/sbom.yml

@@ -0,0 +1,56 @@
+# CycloneDX is the primary artifact; SPDX ships alongside it because procurement and
+# GitHub's own SBOM export API only speak SPDX.
+name: SBOM
+
+on:
+  push:
+    branches: [main]
+  release:
+    types: [published]
+  schedule:
+    - cron: '{{ securityScanCron }}'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  generate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: '{{ hardenRunnerEgress }}'
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: CycloneDX
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: sbom.cdx.json
+          syft-version: 'v{{ syftVersion }}'
+          upload-artifact: false
+
+      - name: SPDX
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          path: .
+          format: spdx-json
+          output-file: sbom.spdx.json
+          syft-version: 'v{{ syftVersion }}'
+          upload-artifact: false
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sbom
+          path: |
+            sbom.cdx.json
+            sbom.spdx.json
+          retention-days: 90

package/templates/layers/security-supply-chain/files/.github/workflows/scorecard.yml

@@ -0,0 +1,51 @@
+# OpenSSF Scorecard — 23 checks, including "are your Actions pinned by SHA".
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '{{ securityScanCron }}'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analysis:
+    # publish_results signs results with the workflow's OIDC token and pushes them to the
+    # public OpenSSF API — meaningless, and rejected, for a repo nobody can read.
+    if: github.repository_visibility == 'public'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+      id-token: write
+    steps:
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: '{{ hardenRunnerEgress }}'
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          sarif_file: results.sarif
+          category: scorecard

package/templates/layers/security-supply-chain/files/.github/workflows/secret-scan.yml

@@ -0,0 +1,62 @@
+# Secret scanning that works everywhere. GitHub's own secret scanning + push protection is
+# the primary control and is configured in repo settings, not here; this is the portable
+# second pass that also covers history and non-GitHub mirrors.
+name: Secret Scan
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '{{ securityScanCron }}'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    env:
+      # Read into the shell as an env var; never interpolated into a `run:` block.
+      GITLEAKS_VERSION: '{{ gitleaksVersion }}'
+    steps:
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: '{{ hardenRunnerEgress }}'
+
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Full history: a secret is still a secret three commits ago.
+          fetch-depth: 0
+          persist-credentials: false
+
+      # The CLI rather than gitleaks-action: the action demands a paid GITLEAKS_LICENSE for
+      # organization-owned repos and fails closed without one.
+      - name: Install gitleaks
+        run: |
+          set -euo pipefail
+          base="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
+          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSfL -o "$archive" "$base/$archive"
+          curl -sSfL -o checksums.txt "$base/gitleaks_${GITLEAKS_VERSION}_checksums.txt"
+          grep " $archive\$" checksums.txt | sha256sum -c -
+          tar -xzf "$archive" gitleaks
+          rm -f "$archive" checksums.txt
+
+      - name: Scan history
+        run: ./gitleaks git . --config .gitleaks.toml --redact=100 --report-format sarif --report-path gitleaks.sarif --exit-code 1
+
+      - name: Upload findings
+        if: always() && (github.repository_visibility == 'public' || vars.ENABLE_CODE_SCANNING == 'true')
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          sarif_file: gitleaks.sarif
+          category: gitleaks

package/templates/layers/security-supply-chain/files/.gitleaks.toml

@@ -0,0 +1,42 @@
+# Extends the built-in ruleset rather than replacing it — a hand-written rule list goes
+# stale the moment a new provider ships a new token prefix.
+title = "{{ solutionName | title }} secret scanning"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "private-key-block"
+description = "PEM private key of any kind"
+regex = '''-----BEGIN[ A-Z0-9]*PRIVATE KEY( BLOCK)?-----'''
+keywords = ["-----begin"]
+tags = ["key", "private"]
+
+[[rules]]
+id = "env-assigned-secret"
+description = "Secret-shaped value assigned in a dotenv or shell export"
+regex = '''(?i)\b(?:export\s+)?[A-Z0-9_]*(?:SECRET|PASSWORD|PASSWD|TOKEN|APIKEY|API_KEY|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*\s*[=:]\s*['"]?([^\s'"#]{12,})'''
+secretGroup = 1
+entropy = 3.0
+keywords = ["secret", "password", "passwd", "token", "apikey", "api_key", "private_key", "access_key"]
+tags = ["generic"]
+
+# Global allowlists win over rule-level ones, so anything genuinely safe belongs here.
+[[allowlists]]
+description = "Templates, examples and fixtures are supposed to contain secret-shaped text"
+condition = "OR"
+paths = [
+  '''\.gitleaks\.toml$''',
+  '''(^|/)\.env\.example$''',
+  '''(^|/)\.env\.sample$''',
+  '''(^|/)(fixtures|testdata|__fixtures__|__snapshots__)/''',
+  '''(^|/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|uv\.lock|poetry\.lock|go\.sum|Cargo\.lock|packages\.lock\.json)$''',
+]
+
+[[allowlists]]
+description = "Obvious placeholders — flagging these trains people to ignore the scanner"
+regexTarget = "secret"
+regexes = [
+  '''(?i)^(changeme|placeholder|example|dummy|sample|redacted|xxx+|<[^>]+>)$''',
+  '''(?i)your[-_]?(secret|token|api[-_]?key|password)[-_]?here''',
+]

package/templates/layers/security-supply-chain/files/SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.**
+
+Use GitHub's [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
+on this repository (Security → Report a vulnerability), or email **{{ securityContact }}**.
+
+Please include: affected version or commit, reproduction steps, and impact. We acknowledge
+reports within **{{ securityResponseDays }} business days** and keep you updated until a fix
+ships or we explain why one will not.
+
+Coordinated disclosure: we ask you to hold public details until a patched release is
+available, and we credit reporters in the advisory unless asked not to.
+
+## Supported versions
+
+Security fixes land on the latest released minor version. Older versions receive fixes only
+while explicitly listed as supported in the release notes.
+
+## What this repository does to protect you
+
+| Control | Where |
+|---|---|
+| Dependency updates with a release-age cooldown | `.github/dependabot.yml` / `renovate.json` |
+| Static analysis, including this repo's own workflows | `.github/workflows/codeql.yml` |
+| Secret scanning across full history | `.github/workflows/secret-scan.yml`, `.gitleaks.toml` |
+| SBOM (CycloneDX + SPDX) on every main build and release | `.github/workflows/sbom.yml` |
+| New-dependency review on every pull request | `.github/workflows/dependency-review.yml` |
+| OpenSSF Scorecard | `.github/workflows/scorecard.yml` |
+| Every GitHub Action pinned by commit SHA | all workflows |
+| Install-time scripts blocked | `.npmrc` |
+
+See [docs/security-supply-chain.md](docs/security-supply-chain.md) for the reasoning and for
+the repository settings that are not expressible as files.