fix: address OpenSSF Scorecard findings - #12
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdded Dependabot config for weekly GitHub Actions updates, introduced a CodeQL GitHub Actions workflow, adjusted workflow-level permissions and an action input in an existing Claude workflow, and added a SECURITY.md describing vulnerability reporting and timelines. Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
The previous SHA was invalid. Updated to the actual v3 commit SHA. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Addresses OpenSSF Scorecard findings by adding missing security policy/documentation and hardening/expanding GitHub security automation (dependency updates and SAST scanning).
Changes:
- Add
SECURITY.mdsecurity policy document. - Add Dependabot configuration for GitHub Actions updates.
- Add a CodeQL workflow and adjust workflow token permissions.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
SECURITY.md |
Introduces a security policy and vulnerability reporting guidance. |
.github/workflows/codeql.yml |
Adds CodeQL SAST workflow configuration. |
.github/workflows/claude.yml |
Changes workflow-level token permissions. |
.github/dependabot.yml |
Enables Dependabot updates for GitHub Actions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
- Replace permissions: read-all with permissions: {} (deny-by-default)
- Add actions: read to CodeQL workflow permissions
- Add concrete security contact email to SECURITY.md
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 9-12: The workflow currently limits CodeQL scans to pushes on
branch `main` (the `push:` key contains `branches: [main]`), so commits pushed
to other branches are skipped; update the `push:` trigger to run on all branches
by replacing the `branches: [main]` restriction (either remove the `branches`
filter or change it to a wildcard such as `branches: ['**']`) while leaving the
existing `pull_request:` trigger intact so PR scans still run.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 01a1f2f4-cab3-4f61-bb40-b942d6264c7f
📒 Files selected for processing (4)
.github/dependabot.yml.github/workflows/claude.yml.github/workflows/codeql.ymlSECURITY.md
The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.
|
* fix: address OpenSSF Scorecard findings - Add SECURITY.md (#8) - Scope workflow token permissions (#9) - Add Dependabot configuration (#10) - Ensure SAST runs on all commits (#11) Closes #8, #9, #10, #11 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use correct CodeQL action commit SHA The previous SHA was invalid. Updated to the actual v3 commit SHA. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Add actions: read to CodeQL workflow permissions - Add concrete security contact email to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Summary
Closes #8, #9, #10, #11
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Chores / Security
Documentation