feat: implement issue #552 — SonarCloud: GitHub Actions / dependency hardening

Merged
DO
5d ago
+204-9

Problem

SonarCloud: GitHub Actions / dependency hardening

From the issue: 2 open SonarCloud finding(s) in combsmith/TalkTerm, worst severity MAJOR. Generated by the org SonarCloud Audit.

Risk

Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.

Test plan

No test files were added or updated. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the existing CI (bats + lint) guards the change.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.

Closes #552

Summary by CodeRabbit

  • Security

    • CI download requests now require HTTPS-only connections, helping prevent insecure transport during tool and checksum downloads.

  • Bug Fixes

    • Improved validation detects download commands that lack the required HTTPS restriction, including chained commands.

  • Tests

    • Expanded CI workflow checks and test coverage to verify both compliant and non-compliant download configurations. Workflows without download commands continue to pass validation.