-
Notifications
You must be signed in to change notification settings - Fork 312
Closed
Closed
Copy link
Labels
documentationImprovements or additions to documentationImprovements or additions to documentationimprovementsecurityworkflow-style
Description
Workflow to Update
Workflow File: .github/workflows/daily-malicious-code-scan.md
Issue: This daily security workflow (312 lines) doesn't import shared/reporting.md which contains markdown style guidelines
Required Changes
Add the import to the frontmatter:
imports:
- shared/reporting.mdThis will provide the workflow with standardized formatting guidelines for security reports:
1. Header Level Guidelines
- Use h3 (###) or lower for all headers to maintain proper document hierarchy
- Never use h2 (##) or h1 (#) in reports - these are reserved for titles
2. Progressive Disclosure Guidelines
- Wrap scan details in
<details><summary><b>Section Name</b></summary>tags - Show critical security findings immediately
- Hide detailed file-by-file analysis in collapsible sections
Example for security reports:
### Security Scan Summary
- Files scanned: 234
- Critical issues: 0
- Warnings: 2
- Status: ✅ Clean
### Critical Findings
[Always visible - empty if none found]
<details>
<summary><b>View Detailed Scan Results</b></summary>
### File-by-File Analysis
[Comprehensive breakdown of each scanned file]
### Warning Details
[Details about non-critical warnings]
</details>
### Recommendations
[Actionable next steps - keep visible if findings exist]3. Security Report Structure
- Summary: Scan status and counts (always visible)
- Critical Findings: Security issues requiring immediate attention (always visible)
- Detailed Results: Per-file scan results (in
<details>tags) - Recommendations: Remediation steps (visible if issues found)
Design Principles (Airbnb-Inspired)
Security reports should:
- Build trust through clarity: Critical issues immediately visible
- Exceed expectations: Include trends (vs. previous scans), context
- Create delight: Use progressive disclosure - don't overwhelm with clean file lists
- Maintain consistency: Follow patterns used across all security workflows
Example Reference
See workflows like daily-secrets-analysis or security-focused workflows that create clear, actionable reports.
Validation
After updating:
- Run the workflow manually with
workflow_dispatch - Verify the report uses h3+ headers (not h1 or h2)
- Check that detailed scan results use
<details>tags - Confirm critical findings and summary are immediately visible
Priority: Medium-High - Daily security workflow (312 lines), important for visibility of security status
AI generated by Workflow Normalizer
- expires on Jan 28, 2026, 12:26 PM UTC
Reactions are currently unavailable
Metadata
Metadata
Labels
documentationImprovements or additions to documentationImprovements or additions to documentationimprovementsecurityworkflow-style
Type
Fields
Give feedbackNo fields configured for issues without a type.