🔒 [보안] CLI 무제한 파일 읽기 취약점 수정

.github/workflows/bandit.yml

@@ -0,0 +1,35 @@
+name: bandit
+
+on:
+  push:
+    branches:
+      - develop
+      - main
+  pull_request:
+    branches:
+      - develop
+      - main
+
+permissions:
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  bandit-scan:
+    name: Bandit Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          version: "0.8.6"
+          enable-cache: false
+      - name: Sync Python dependencies
+        run: uv sync --project services/analysis-engine --group dev --frozen
+      - name: Run Bandit
+        working-directory: services/analysis-engine
+        run: uv run bandit -c pyproject.toml -r src

.github/workflows/build-baseline.yml

@@ -12,12 +12,6 @@ on:
     tags:
       - "v*"
 
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{ github.repository }}-${{
-    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
 
@@ -294,11 +288,9 @@ jobs:
       - name: Explain non-blocking macOS amd64 artifact upload failure
         if: ${{ steps.upload-macos-amd64.outcome == 'failure' }}
         run: |
-          {
-            echo "Artifact upload failed after the macOS amd64 bundle was packaged."
-            echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence."
-            echo "Tag and release builds remain blocking because release publication requires uploaded artifacts."
-          } >> "$GITHUB_STEP_SUMMARY"
+          echo "Artifact upload failed after the macOS amd64 bundle was packaged." >> "$GITHUB_STEP_SUMMARY"
+          echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence." >> "$GITHUB_STEP_SUMMARY"
+          echo "Tag and release builds remain blocking because release publication requires uploaded artifacts." >> "$GITHUB_STEP_SUMMARY"
 
   build-macos-arm64:
     name: build / macos / arm64
@@ -358,11 +350,9 @@ jobs:
       - name: Explain non-blocking macOS arm64 artifact upload failure
         if: ${{ steps.upload-macos-arm64.outcome == 'failure' }}
         run: |
-          {
-            echo "Artifact upload failed after the macOS arm64 bundle was packaged."
-            echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence."
-            echo "Tag and release builds remain blocking because release publication requires uploaded artifacts."
-          } >> "$GITHUB_STEP_SUMMARY"
+          echo "Artifact upload failed after the macOS arm64 bundle was packaged." >> "$GITHUB_STEP_SUMMARY"
+          echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence." >> "$GITHUB_STEP_SUMMARY"
+          echo "Tag and release builds remain blocking because release publication requires uploaded artifacts." >> "$GITHUB_STEP_SUMMARY"
 
   gate-macos:
     name: gate / build / macos

.github/workflows/ci.yml

@@ -10,12 +10,6 @@ on:
       - develop
       - main
 
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{ github.repository }}-${{
-    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
 

.github/workflows/codeql.yml

@@ -0,0 +1,39 @@
+name: codeql
+
+on:
+  push:
+    branches:
+      - develop
+      - main
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  analyze:
+    name: codeql
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - javascript-typescript
+          - python
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0

.github/workflows/ossf-scorecard.yml

@@ -9,10 +9,6 @@ on:
       - develop
       - main
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: false
-
 permissions: read-all
 
 jobs:

.github/workflows/release.yml

@@ -1,6 +1,10 @@
 name: release
 
 on:
+  pull_request:
+    branches:
+      - develop
+      - main
   push:
     branches:
       - develop
@@ -9,10 +13,6 @@ on:
       - "v*"
   workflow_dispatch:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: false
-
 permissions:
   contents: read
 

.github/workflows/sbom.yml

@@ -15,12 +15,6 @@ on:
     types:
       - published
 
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{ github.repository }}-${{
-    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
 

.github/workflows/secret-scan-gate.yml

@@ -0,0 +1,29 @@
+name: secret-scan-gate
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - main
+  push:
+    branches:
+      - develop
+      - main
+
+permissions:
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  secret-scan:
+    name: secret-scan-gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Scan for common hardcoded secrets
+        run: |
+          ! git grep -nE '(g[h]p_|g[h]o_|A[K]IA[0-9A-Z]{16}|A[I]za[0-9A-Za-z\-_]{35}|BEGIN (R[S]A|E[C]|OPENS[S]H|P[G]P) PRIVATE KEY)' -- . ':(exclude)package-lock.json' ':(exclude)node_modules/**'

.github/workflows/security-audit.yml

@@ -1,15 +1,14 @@
-name: security-backstop
+name: security-audit
 
 on:
+  pull_request:
+    branches:
+      - develop
+      - main
   push:
     branches:
       - develop
       - main
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: false
 
 permissions:
   contents: read
@@ -20,12 +19,9 @@ env:
   GIT_CONFIG_VALUE_0: develop
 
 jobs:
-  security-backstop:
-    name: security-backstop
+  audit:
+    name: security-audit
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -53,45 +49,10 @@ jobs:
         run: uv sync --project services/analysis-engine --group dev --frozen
       - name: Audit Python dependencies
         run: uv run --project services/analysis-engine --with pip-audit==2.8.0 pip-audit --local --strict
-      - name: Run Bandit
-        working-directory: services/analysis-engine
-        run: uv run bandit -c pyproject.toml -r src
       - name: Install stable Rust toolchain
         run: rustup toolchain install stable --profile minimal
       - name: Install cargo-audit
         run: cargo +stable install cargo-audit --locked
       - name: Audit Rust dependencies
         working-directory: apps/desktop/src-tauri
         run: cargo +stable audit
-      - name: Scan for common hardcoded secrets
-        run: |
-          ! git grep -nE '(g[h]p_|g[h]o_|A[K]IA[0-9A-Z]{16}|A[I]za[0-9A-Za-z\-_]{35}|BEGIN (R[S]A|E[C]|OPENS[S]H|P[G]P) PRIVATE KEY)' -- . ':(exclude)package-lock.json' ':(exclude)node_modules/**'
-      - name: Run Trivy filesystem scan summary
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: fs
-          scan-ref: .
-          version: v0.71.2
-          format: table
-          severity: CRITICAL,HIGH,MEDIUM
-          exit-code: "0"
-          skip-dirs: services/analysis-engine/.venv
-          trivyignores: ./.trivyignore
-      - name: Run Trivy filesystem scan
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: fs
-          scan-ref: .
-          version: v0.71.2
-          format: sarif
-          output: trivy-results.sarif
-          severity: CRITICAL,HIGH,MEDIUM
-          limit-severities-for-sarif: true
-          exit-code: "1"
-          skip-dirs: services/analysis-engine/.venv
-          trivyignores: ./.trivyignore
-      - name: Upload Trivy scan results to GitHub Security tab
-        if: always()
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
-        with:
-          sarif_file: trivy-results.sarif

.github/workflows/trivy.yml

@@ -0,0 +1,54 @@
+name: trivy
+
+on:
+  push:
+    branches:
+      - develop
+      - main
+
+permissions:
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  trivy-fs-scan:
+    name: trivy-fs-scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Run Trivy filesystem scan summary
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0; SHA pinning retained as supply-chain attack mitigation, do not replace with tag.
+        with:
+          scan-type: fs
+          scan-ref: .
+          version: v0.71.2
+          format: table
+          severity: CRITICAL,HIGH,MEDIUM
+          exit-code: '0'
+          skip-dirs: 'services/analysis-engine/.venv'
+          trivyignores: ./.trivyignore
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0; SHA pinning retained as supply-chain attack mitigation, do not replace with tag.
+        with:
+          scan-type: fs
+          scan-ref: .
+          version: v0.71.2
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH,MEDIUM
+          limit-severities-for-sarif: true
+          exit-code: '1'
+          skip-dirs: 'services/analysis-engine/.venv'
+          trivyignores: ./.trivyignore
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation.
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif

CHANGELOG.md

@@ -10,11 +10,13 @@
 
 ### Changed
 
-- Consolidated Bandit, dependency audits, supplemental secret checks, and Trivy into one trusted-branch security backstop, delegated CodeQL to GitHub default setup, and removed duplicate local PR security and release-preflight runs.
 - Pinned npm `10.9.9` as the approved lockfile generator, activated it through Node-bundled Corepack before dependency consumption, and fail closed unless its bundled `tar` is at least `7.5.19`; primary CI still consumes the committed lock only through frozen `npm ci` validation, rejects mutable npm resolution in the lock gate, requires integrity evidence for public-registry lock entries, and preserves generator-sensitive root `@esbuild/*` peer metadata.
 
 ### Fixed
 
+- Classify `--job` console handles (`CONIN$`/`CONOUT$`) from the 2021-12-30 console-handles contract rather than the naming-a-file reserved list, fail-close the legacy `CLOCK$` device, keep drive-relative job paths from reaching `os.lstat` or `os.open`, and log only the lexical authority class (never the rejected path).
+- Reject Windows UNC/network, device-namespace, NTFS alternate-stream, and reserved Win32 device-alias `--job` file shapes before any filesystem metadata lookup, including mixed-separator UNC/device forms after `/`→`\\` translation and aliases exposed only after Win32 leading/trailing ASCII-space/period, extension, stream-suffix, and case normalization, so a caller-selected local job file cannot silently acquire remote-share, device, or named-stream authority on another host.
+- Reject unknown CLI arguments and extra `--status` operands before reading standard input, keep valid whitespace-prefixed inline JSON `--job` payloads on the inline path, reject surrogate-bearing inline job arguments and text-only injected stdin with the stable UTF-8 validation error instead of terminating on an uncaught encoding exception, and fail malformed explicit invocations immediately instead of blocking on unrelated pipes or special files. File-backed `--job` reads now reject symlinks and non-regular paths before opening, request no-follow/close-on-exec/nonblocking descriptor semantics where available, verify the opened descriptor still identifies the preflighted regular file, and enforce the byte bound through that descriptor; where supported, nonblocking acquisition prevents a path swapped to a FIFO/device after preflight from turning `open()` itself into an unbounded wait.
 - Upgraded the local score PDF parser to `pdfjs-dist` 6.2.108, pinned Undici 7.29.0 across the workspace, and constrained PDF loading to copied in-memory bytes with a same-origin bundled worker and npm-generated lock provenance.
 
 ## [0.1.3] - 2026-04-29

docs/architecture/overview.md

@@ -41,6 +41,6 @@ GitHub is the source of truth for repository governance, PR review, CI/CD, Code
 
 ## CI/CD and release flow
 
-- PRs into `develop` and `main` run repository CI, SBOM, and platform builds alongside organization-required OSV, dependency-review, Trivy, CodeQL/code-quality, Semgrep SAST, Strix, and Noema evidence; consolidated local security backstops run after trusted-branch pushes
+- PRs into `develop` and `main` run CI, dependency review, security audit, secret-scan gate, SBOM generation, and CodeQL
 - release flows publish desktop artifacts plus SBOM evidence to GitHub Releases through a tag-driven draft-before-publish path
 - branch protection connects stable required checks after bootstrap workflows exist