docs: update security.txt and re-introduce workflow to update the expiry date every year

[morri-son]

Summary

Add security.txt and a workflow to update it for Open Component Model vulnerability disclosure, aligned with NeoNephos Security Guidelines and CRA compliance requirements.

Important: The organization-wide SECURITY.md has been moved to a separate PR (open-component-model/.github#115) in the repository.

Changes

• ✅ Update website/static/.well-known/security.txt (RFC 9116 compliance)

  • Reference new reporting channels and contacts
  • Add Expires field with automated renewal workflow

• ✅ Restore automated security.txt expiry renewal workflow

  • Runs every weekday in December at 09:00 UTC
  • Automatically updates Expires field to next year
  • Creates idempotent PR for review and merge
  • Ensures RFC 9116 compliance without manual maintenance

Related PRs

⚠️ MERGE ORDER MATTERS:

1. FIRST: Merge open-component-model/.github#115

   • Organization-wide SECURITY.md (applies to all repos)
   • NeoNephos Security Guidelines compliance
   • CRA stewardship statement per Linux Foundation
   • Commercial intent declaration

2. THEN: Merge this PR (open-component-model/open-component-model#2386)

   • security.txt and workflow for updates

Reason: The .github SECURITY.md is organization-wide and is referenced by this PR's security.txt updates.

Test Plan

• Verify security.txt is valid per RFC 9116
• Verify security.txt references correct SECURITY.md location
• Verify workflow runs correctly (manual trigger or wait for December)
• Verify Expires field updates to next year + 12-31

Closes

• Update Security policy for OCM project (also linked on Website) ocm-project#683 (security.txt automation)

[netlify]

👷 Deploy Preview for ocm-website processing.

Name	Link
🔨 Latest commit	3cf8988
🔍 Latest deploy log	https://app.netlify.com/projects/ocm-website/deploys/6aaa72e3f862670009cd61a0

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a vulnerability disclosure policy and security contacts, updates .well-known/security.txt (contacts and Expires), changes the GitHub Actions workflow to sparse-checkout and bump only the Expires field on weekdays, and extends the spell-check wordlist with three security terms.

Changes

Security & Release Flow

Layer / File(s)	Summary
Policy document SECURITY.md	Adds a new vulnerability disclosure document describing reporting channels (GitHub private advisory + TSC email), supported versions, response timelines, CVSS-based targets, coordinated disclosure expectations, and contact list.
Public security descriptor website/static/.well-known/security.txt	Replaces SAP contact with GitHub advisories and TSC mailto, adds Canonical and Policy links (points to SECURITY.md), sets Preferred-Languages: en, and updates Expires to 2027-12-31T00:00:00.000Z.
Automation: expiry-only renewal .github/workflows/website-update-security-txt.yaml	Changes December cron to weekdays at 09:00 UTC; switches to sparse-checkout for website/static/.well-known/security.txt; removes external fetch; adds an in-place step that computes next year and rewrites the Expires: line with YYYY-12-31T00:00:00.000Z; updates PR branch/title/commit/body to reflect expiry-only renewal and RFC 9116 reference.

Spell-check vocabulary

Layer / File(s)	Summary
Wordlist additions .github/config/wordlist.txt	Inserts three terms into the repository wordlist: cvss (line ~176), mitigations (line ~446), and openssf (line ~523).

Sequence Diagram(s)

sequenceDiagram
    participant Workflow as GitHub Actions workflow
    participant Repo as Repository (files)
    participant GitHub as GitHub API (PR)
    participant Runner as Actions runner

    Workflow->>Runner: scheduled run (Dec weekdays 09:00 UTC)
    Runner->>Repo: sparse-checkout `website/static/.well-known/security.txt`
    Runner->>Runner: compute next year (date +1)
    Runner->>Repo: rewrite `Expires:` in security.txt
    Runner->>GitHub: create branch `security/renew-security-txt` and PR (Expires-only update)
    GitHub->>Repo: PR created (title/commit/description reference RFC 9116)

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR addresses the SECURITY.md creation requirement from issue #1021 as specified in the acceptance criteria, implementing vulnerability disclosure process documentation.
Out of Scope Changes check	✅ Passed	All changes are within scope: SECURITY.md creation, security.txt updates, wordlist additions, and workflow updates directly support the security disclosure policy objective from issue #1021.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly describes the security.txt update and annual expiry workflow. It omits the new SECURITY.md file, but it accurately covers substantial changes in the pull request.
Description check	✅ Passed	The description directly explains the security.txt changes, the expiry renewal workflow, vulnerability disclosure channels, and related security policy work.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{🐰 I nibble at lines and hop with glee,
Contacts set, expiry bumped to see,
cvss, mitigations, openssf I add,
A tidy PR, neither loud nor mad.
I twitch my whiskers — secure and glad.}

_{Comment @coderabbitai help to get the list of available commands.}

[morri-son]

neonephos/guidelines-development#7 has been approved, so this PR can make use of the ne SECURITY.md template from NeoNephos.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/website-update-security-txt.yaml (1)

5-7: Adjust Expires calculation to stay within RFC 9116's <1-year horizon.

The current workflow runs on December 1st and adds 1 year to the existing Expires timestamp, which typically sets the date to December 31st of the following year. This results in an Expires value ~13 months in the future, exceeding RFC 9116 section 2.5.5's recommendation to keep Expires less than one year ahead.

To comply with the RFC, set the Expires date to approximately 11–12 months from the workflow execution date rather than hardcoding to a fixed end-of-year date.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/website-update-security-txt.yaml around lines 5 - 7, The
workflow currently schedules on "0 9 1 12 *" and extends the security.txt
Expires field by adding a full year which can push expiry beyond 12 months;
change the Expires calculation step so it computes Expires relative to the
workflow run date (e.g., run_date + ~330 days or run_date + 11 months) instead
of forcing an end-of-year date; update the step that generates the Expires
timestamp (the job/step that currently adds 1 year to the existing Expires) to
produce a date <1 year ahead (approx 11–12 months) formatted per RFC 9116 before
writing security.txt.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/website-update-security-txt.yaml:
- Around line 27-36: The step "Bump Expires date by one year" currently proceeds
even if parsing/computing NEW fails; update the step to validate parsing by
checking that CURRENT is non-empty and NEW was successfully computed (e.g., test
-n "$CURRENT" and test -n "$NEW" or check date exit status) before running sed,
and if either is empty or date failed, print a clear error (including values of
FILE and CURRENT) and exit 1 to fail the job; reference the variables/labels
FILE, CURRENT, NEW and the step name to locate where to add the checks and early
exit.

---

Nitpick comments:
In @.github/workflows/website-update-security-txt.yaml:
- Around line 5-7: The workflow currently schedules on "0 9 1 12 *" and extends
the security.txt Expires field by adding a full year which can push expiry
beyond 12 months; change the Expires calculation step so it computes Expires
relative to the workflow run date (e.g., run_date + ~330 days or run_date + 11
months) instead of forcing an end-of-year date; update the step that generates
the Expires timestamp (the job/step that currently adds 1 year to the existing
Expires) to produce a date <1 year ahead (approx 11–12 months) formatted per RFC
9116 before writing security.txt.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b6067089-1525-4689-b6f7-d182f52b6e90

📥 Commits

Reviewing files that changed from the base of the PR and between 2e601ca and 6329c9a.

📒 Files selected for processing (4)

• .github/config/wordlist.txt
• .github/workflows/website-update-security-txt.yaml
• SECURITY.md
• website/static/.well-known/security.txt

[Skarlso]

This closes the attached issue but where is assurance-case.md and secure-design.md docs? Is that another PR?

[frewilhelm]

The neonephos PR is not merged yet - should we wait?

[matthiasbruns]

Tackle the open points and I am happy

[coderabbitai]

♻️ Duplicate comments (1)

.github/workflows/website-update-security-txt.yaml (1)

27-54: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Remove the incomplete duplicate step — it causes a bash syntax error on every run.

Lines 27–34 contain an abandoned partial copy of the "Bump Expires" step, missing the closing fi for the if [[ -z ... ]] block. GitHub Actions executes both list items sequentially; the first one causes bash to exit with unexpected end of file under set -euo pipefail, so the workflow always fails before the correct step (lines 35–54) can execute.

The incomplete step also uses the ::error:: annotation style inconsistent with the >&2 pattern in the real step, and contains none of the date-computation logic — it is clearly a stale draft left over when the "fail-fast" fix from the previous review round was appended rather than merged in-place.

🐛 Proposed fix — drop the orphaned first step

-    - name: Bump Expires date by one year
-      run: |
-        set -euo pipefail
-        FILE=website/static/.well-known/security.txt
-        CURRENT=$(sed -n 's/^Expires:[[:space:]]*//p' "$FILE")
-        if [[ -z "${CURRENT}" ]]; then
-          echo "::error::Missing Expires field in ${FILE}"
-          exit 1
-
     - name: Bump Expires date by one year
       run: |
         set -euo pipefail

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/website-update-security-txt.yaml around lines 27 - 54,
Remove the stray/incomplete duplicate job step named "Bump Expires date by one
year" (the first occurrence) that is missing the closing fi and uses the
::error:: annotation; keep only the complete "Bump Expires date by one year"
step that parses CURRENT, computes NEW with date and replaces the Expires line.
In practice, delete the earlier run: | block (the abandoned partial copy) so the
workflow contains a single correct Bump Expires step (the one that sets FILE,
extracts CURRENT, computes NEW with date -u -d ... || date -u -j ..., checks
NEW, runs sed -i, and prints the update).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/website-update-security-txt.yaml:
- Around line 27-54: Remove the stray/incomplete duplicate job step named "Bump
Expires date by one year" (the first occurrence) that is missing the closing fi
and uses the ::error:: annotation; keep only the complete "Bump Expires date by
one year" step that parses CURRENT, computes NEW with date and replaces the
Expires line. In practice, delete the earlier run: | block (the abandoned
partial copy) so the workflow contains a single correct Bump Expires step (the
one that sets FILE, extracts CURRENT, computes NEW with date -u -d ... || date
-u -j ..., checks NEW, runs sed -i, and prints the update).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2a29f7b1-b863-489e-8fab-7c0d75e8ac3d

📥 Commits

Reviewing files that changed from the base of the PR and between f24dba6 and 3f55e07.

📒 Files selected for processing (2)

• .github/config/wordlist.txt
• .github/workflows/website-update-security-txt.yaml

✅ Files skipped from review due to trivial changes (1)

• .github/config/wordlist.txt

[morri-son]

put this back to draft, until neonephos/guidelines-development#7 is merged AND approved by NeoNephos TAG.

[github-actions]

This pull request was marked as stale because it has not had recent activity.

[matthiasbruns]

@morri-son status?