Skip to content

Add security workflows pre-commit hooks, dependency review, CodeQL #196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rahuldevikar761 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add security workflows pre-commit hooks, dependency review, CodeQL #196

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c67e0b6
Add security workflows: pre-commit hooks, dependency review, CodeQL f…
rahuldevikar761 Feb 10, 2026
51bfb7b
Add security workflows: pre-commit hooks, dependency review
rahuldevikar761 Feb 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# Dependency Review - blocks PRs that introduce known-vulnerable dependencies
name: Dependency Review
Comment on lines +1 to +2
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR title mentions adding CodeQL, but there’s no CodeQL workflow currently under .github/workflows (only CI and dependency-review). Either add the CodeQL workflow in this PR or adjust the PR title/description to match what’s actually being introduced.

Copilot uses AI. Check for mistakes.

Comment on lines +1 to +3
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow file appears to be committed with CRLF line endings (e.g., uses: ...@v4\r). The repo’s .editorconfig requires LF, so please normalize this file to LF to prevent cross-platform churn.

Copilot uses AI. Check for mistakes.
on:
pull_request:
branches: [main]
Comment on lines +4 to +6
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow only runs for PRs targeting main, but the existing CI workflow is configured for both main and master. If master is still a supported target branch in this repo, dependency review will be skipped for those PRs—consider including master here as well (or remove master from CI if it’s no longer used).

Copilot uses AI. Check for mistakes.

permissions:
contents: read
pull-requests: write

jobs:
dependency-review:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Dependency Review
uses: actions/dependency-review-action@v4
with:
fail-on-severity: high
comment-summary-in-pr: always
deny-licenses: GPL-3.0-only, AGPL-3.0-only
Comment on lines +8 to +24
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow grants pull-requests: write and forces comment-summary-in-pr: always. If PR-commenting isn’t strictly required, consider dropping to pull-requests: read (principle of least privilege). If commenting is required, ensure this won’t break on PRs from forks where GITHUB_TOKEN typically can’t write PR comments (e.g., make commenting conditional or switch to a safer reporting mode).

Copilot uses AI. Check for mistakes.
43 changes: 43 additions & 0 deletions .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# Pre-commit hooks for Agent365-nodejs
# Install: pip install pre-commit && pre-commit install
# Run manually: pre-commit run --all-files
Comment on lines +1 to +3
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This new file appears to use CRLF line endings (e.g., lines match ...prettier\r). The repo’s .editorconfig requires end_of_line = lf, so please normalize this file to LF to avoid noisy diffs and formatting churn across platforms.

Copilot uses AI. Check for mistakes.

repos:
# Gitleaks - detect secrets in code
- repo: https://github.com/gitleaks/gitleaks
rev: v8.18.4
hooks:
- id: gitleaks

# Whitespace fixes
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.6.0
hooks:
- id: trailing-whitespace
args: [--markdown-linebreak-ext=md]
- id: end-of-file-fixer
- id: mixed-line-ending
args: [--fix=lf]
- id: check-merge-conflict
- id: check-yaml
args: [--allow-multiple-documents]
- id: check-json

# Node.js/TypeScript specific
- repo: https://github.com/pre-commit/mirrors-eslint
rev: v9.39.1
hooks:
- id: eslint
files: \.[jt]sx?$
types: [file]
additional_dependencies:
- eslint@9.39.1
- typescript
- "@typescript-eslint/parser"
- "@typescript-eslint/eslint-plugin"
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The eslint pre-commit hook is running in an isolated pre-commit environment but the repo’s eslint.config.mjs imports modules that aren’t listed under additional_dependencies (e.g., "@eslint/js" and "typescript-eslint"). As-is, the hook is likely to fail with module-not-found errors. Consider either adding the missing dependencies (and pinning them to the repo’s versions) or switching to a local hook that runs the workspace’s pnpm-managed eslint.

Suggested change
- "@typescript-eslint/eslint-plugin"
- "@typescript-eslint/eslint-plugin"
- "@eslint/js"
- "typescript-eslint"

Copilot uses AI. Check for mistakes.

- repo: https://github.com/pre-commit/mirrors-prettier
rev: v4.0.0-alpha.8
hooks:
- id: prettier
types_or: [javascript, typescript, json, yaml, markdown]
Comment on lines +39 to +43
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The prettier hook is pinned to an alpha release (v4.0.0-alpha.8). Using prerelease formatter versions can cause unexpected formatting churn and makes it harder to keep contributors in sync. Consider pinning to the latest stable prettier (or aligning with a repo-managed prettier dependency if/when one is added).

Copilot uses AI. Check for mistakes.