fix: address OpenSSF Scorecard findings - #21
Merged
Merged
Conversation
- Add SECURITY.md (#16) - Scope workflow token permissions to least privilege (#17) - Pin all GitHub Action dependencies to commit SHAs (#18) - Add CodeQL SAST workflow for all commits (#19) - Broaden CI pull_request trigger to cover all branches (#20) Closes #16, #17, #18, #19, #20 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdded a new CodeQL workflow, introduced workflow-level empty Changes
Sequence Diagram(s)Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The repo contains HTML and Groovy, not JavaScript. CodeQL supports analyzing GitHub Actions workflows via the 'actions' language. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR addresses several OpenSSF Scorecard findings by adding a security policy, tightening GitHub Actions token permissions, pinning Actions to commit SHAs, adding a CodeQL workflow, and broadening some workflow triggers.
Changes:
- Add
SECURITY.mdto document a security policy and reporting process. - Update existing workflows to scope
GITHUB_TOKENpermissions and pinuses:dependencies to commit SHAs. - Add a CodeQL SAST workflow.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
SECURITY.md |
Adds a security policy and vulnerability reporting guidance. |
.github/workflows/sonarcloud.yml |
Adjusts trigger scope and refactors permissions placement; pins Actions. |
.github/workflows/dependabot-automerge.yml |
Pins Actions; refactors permissions for Dependabot automation. |
.github/workflows/codeql.yml |
Introduces CodeQL workflow with pinned dependencies and scoped permissions. |
.github/workflows/claude.yml |
Adds workflow-level default permissions (job already declares explicit permissions). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
SECURITY.md (1)
5-8: Use concrete supported versions instead oflatest.
latestis ambiguous for security support and can age poorly; listing concrete release lines/branches is clearer.As per coding guidelines, "
**/*.md: Focus on documentation quality ... and proper heading hierarchy. Flag ... ambiguous instructions."🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@SECURITY.md` around lines 5 - 8, Replace the ambiguous "latest" entry in the SECURITY.md support table with explicit, concrete supported release lines (e.g., "v2.x", "v1.9") and their end-of-life or support status; locate the table containing the "Version" header and the cell with the string "latest" and update it to list each supported version row-by-row with clear support markers and dates, and ensure the document headings around the table follow proper hierarchy (e.g., use H2/H3 consistently) for clarity.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/claude.yml:
- Line 12: The workflow-level permissions line "permissions: read-all" should be
removed or replaced to avoid overly broad defaults; locate the top-level
permissions declaration in the workflow and delete the "permissions: read-all"
entry (or change it to an empty permissions object like "permissions: {}") so
that the job-level permissions defined later (the explicit permissions block
around the jobs) remain the source of truth and least-privilege is preserved.
In @.github/workflows/codeql.yml:
- Line 3: The workflow-level "permissions: read-all" setting is too broad;
remove that top-level "permissions: read-all" entry or replace it with minimal
explicit permissions that match the job-level scopes (e.g., only the specific
permissions used by the workflow), and rely on the job-level permissions already
defined (the explicit permissions block around lines 17-19) to grant necessary
access; ensure no workflow-level wildcard permissions remain so the workflow
follows the least-privilege principle.
In @.github/workflows/dependabot-automerge.yml:
- Line 8: The workflow-level permission "permissions: read-all" is too
broad—replace that top-level "permissions: read-all" entry with minimal explicit
read scopes (e.g., only the specific read permissions your jobs need such as
contents: read and pull-requests: read) so the workflow adheres to
least-privilege; leave the existing job-level permissions (the job-level write
scopes defined later) intact so they continue to override and grant required
write access.
In @.github/workflows/sonarcloud.yml:
- Line 3: Remove the workflow-level permissive entry "permissions: read-all" and
rely on the job-level permissions already declared (e.g., "contents: read" and
"pull-requests: read") so the workflow follows least-privilege; simply delete
the top-level "permissions: read-all" key from the workflow YAML and ensure no
other workflow-level permissions remain that broaden access beyond the job-level
settings.
In `@SECURITY.md`:
- Line 15: The guidance "Instead, please send an email to the maintainers or use
[GitHub's private vulnerability reporting]..." is ambiguous because it omits a
contact address; update SECURITY.md by adding an explicit security contact email
(e.g., security@yourdomain.com) immediately after that sentence so reporters
have a direct channel, and ensure the new line includes clear wording like
"Email security@yourdomain.com to report vulnerabilities" alongside the existing
GitHub advisories link.
---
Nitpick comments:
In `@SECURITY.md`:
- Around line 5-8: Replace the ambiguous "latest" entry in the SECURITY.md
support table with explicit, concrete supported release lines (e.g., "v2.x",
"v1.9") and their end-of-life or support status; locate the table containing the
"Version" header and the cell with the string "latest" and update it to list
each supported version row-by-row with clear support markers and dates, and
ensure the document headings around the table follow proper hierarchy (e.g., use
H2/H3 consistently) for clarity.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6286b251-22fb-4b8a-a5c6-e6945b6188f1
📒 Files selected for processing (5)
.github/workflows/claude.yml.github/workflows/codeql.yml.github/workflows/dependabot-automerge.yml.github/workflows/sonarcloud.ymlSECURITY.md
- Replace permissions: read-all with permissions: {} (deny-by-default)
- Reduce dependabot-automerge job token to read-only (app token handles writes)
- Add actions: read to CodeQL job permissions
- Add concrete security contact email and version target to SECURITY.md
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.
|
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #16, #17, #18, #19, #20
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
New Features
Documentation