SonarCloud: GitHub Actions / dependency hardening

2 open SonarCloud finding(s) in combsmith/TalkTerm, worst severity MAJOR. Generated by the org SonarCloud Audit.

Findings

Rule	Count	Representative message
githubactions:S6506	2	Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it i

Affected files

.github/workflows/ci.yml (2)

Priority

Labeled priority:major — mapped from this bucket's worst SonarCloud severity (MAJOR).

Acceptance

All findings in this workstream resolved to zero in SonarCloud
No behavior change; CI green
Real fixes (no blanket NOSONAR unless a confirmed false positive, noted inline)

Idempotent issue — updated automatically each audit run; auto-closed when the finding count reaches zero.

Dev-Lead Implementation Plan

Issue: #552 — SonarCloud: GitHub Actions / dependency hardening

Scope

Resolve the 2 githubactions:S6506 findings by restricting the two gitleaks curl downloads in .github/workflows/ci.yml to HTTPS (--proto '=https', matching the existing yq install step), and lock the invariant with a regression guard.

Implementation Checklist

.github/workflows/ci.yml: add --proto '=https' to both gitleaks curl calls (binary + checksums)
scripts/test-ci-workflow.sh: new Check 10 — every curl must pass --proto '=https' (S6506)
scripts/test-ci-workflow.test.sh: update accept-fixtures to include --proto '=https'; add reject cases

Tests to Write

curl without --proto '=https' (has --retry) is rejected
chained curl where only one segment enforces HTTPS is rejected
existing accept cases continue to pass with --proto '=https'

Test Command

bash scripts/test-ci-workflow.test.sh && bash scripts/test-ci-workflow.sh

Dev-Lead: Implementation Complete — PR #553

The implementation for issue #552 is durable: commits are pushed and a pull request is open. This record is backed by verifiable artifacts you can confirm in one click.

Pull request: feat: implement issue #552 — SonarCloud: GitHub Actions / dependency hardening #553
Head commit: b1966be051b34ecaba2a36b350431628eb4df1fb
Net change against main: 3 file(s), +99/-9 lines
Run: https://github.com/combsmith/TalkTerm/actions/runs/39493360055

Review happens on the PR. Acceptance criteria and test results are evidenced by the PR's diff and CI checks — not asserted here. If a later stage fails, this claim is retracted in place.

feat: implement issue #552 — SonarCloud: GitHub Actions / dependency …

Navigation Menu

Repository navigation

SonarCloud: GitHub Actions / dependency hardening #552