Conversation
- Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughWorkflow-level permissions were set to a default-deny ( Changes
Sequence Diagram(s)sequenceDiagram
participant Runner as GitHub Actions Runner
participant Checkout as actions/checkout
participant Init as github/codeql-action/init
participant Analyze as github/codeql-action/analyze
participant GitHub as GitHub API
Runner->>Checkout: checkout repository
Runner->>Init: initialize CodeQL DB (matrix language)
Init->>GitHub: fetch analysis configuration
Runner->>Analyze: run CodeQL analysis (category: /language:actions)
Analyze->>GitHub: upload security events/results
GitHub-->>Runner: job status / annotations
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
This PR aims to remediate several OpenSSF Scorecard findings by adding a security policy, tightening GitHub Actions permissions, pinning GitHub Actions to commit SHAs, and introducing CodeQL scanning.
Changes:
- Add
SECURITY.mdto document vulnerability reporting and disclosure expectations. - Add a new CodeQL workflow and pin multiple GitHub Actions dependencies to commit SHAs.
- Adjust workflow token permissions (but several workflows currently set
permissions: read-allat the workflow level).
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
SECURITY.md |
Adds a security policy and vulnerability reporting guidance. |
.github/workflows/sonarcloud.yml |
Sets workflow/job permissions and pins actions used for Sonar analysis. |
.github/workflows/dependabot-automerge.yml |
Scopes permissions (job-level) and pins actions for Dependabot auto-merge flow. |
.github/workflows/codeql.yml |
Adds a CodeQL workflow with pinned actions and job-level security-events permissions. |
.github/workflows/claude.yml |
Adds workflow-level permissions declaration (currently read-all) alongside job-level permissions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Replace permissions: read-all with permissions: {} (deny-by-default)
in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
SECURITY.md (1)
15-16: Consider using a relative URL for the private vulnerability reporting link.The hardcoded URL
https://github.com/petry-projects/markets/security/advisories/newwill break if the repository is forked or renamed. Consider using a relative reference or noting that users should adjust this URL for forks.📝 Suggested change
Instead, please send an email to **security@petry-projects.dev** or use -[GitHub's private vulnerability reporting](https://github.com/petry-projects/markets/security/advisories/new). +[GitHub's private vulnerability reporting](../../security/advisories/new).Note: Relative URLs work in GitHub's rendered Markdown and will correctly resolve for forks.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@SECURITY.md` around lines 15 - 16, Replace the hardcoded GitHub advisory URL in SECURITY.md (the string "https://github.com/petry-projects/markets/security/advisories/new") with a relative URL or note to adjust for forks; specifically update the link text that currently points to the absolute advisory path so it uses a relative path like "/security/advisories/new" (or add a brief parenthetical instructing users of forks to update the URL) to ensure the link resolves correctly after renames/forks.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@SECURITY.md`:
- Around line 15-16: Replace the hardcoded GitHub advisory URL in SECURITY.md
(the string "https://github.com/petry-projects/markets/security/advisories/new")
with a relative URL or note to adjust for forks; specifically update the link
text that currently points to the absolute advisory path so it uses a relative
path like "/security/advisories/new" (or add a brief parenthetical instructing
users of forks to update the URL) to ensure the link resolves correctly after
renames/forks.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 208fb050-be94-48b5-a772-46c4c2e506ac
📒 Files selected for processing (5)
.github/workflows/claude.yml.github/workflows/codeql.yml.github/workflows/dependabot-automerge.yml.github/workflows/sonarcloud.ymlSECURITY.md
Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
SECURITY.md (1)
5-8: Replacelatestwith concrete supported version(s).
latestis ambiguous in a security policy. Consider listing explicit versions/ranges (or a clearly named support channel likemain) so users know exactly what is covered.As per coding guidelines, “Focus on Markdown best practices, clear and consistent formatting, correct link references, and accurate technical documentation. Flag broken links, inconsistent heading levels, and unclear instructions.”
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@SECURITY.md` around lines 5 - 8, Replace the ambiguous table entry "latest" in the Version column with explicit supported version identifiers or a named branch (e.g., "v1.2.x, v1.3.x" or "main") and update any adjacent text to describe the support policy; specifically edit the table row that currently reads "| latest | :white_check_mark: |" so it lists concrete version strings or a clear channel name and, if needed, add a short note under the table explaining the support window/criteria and how to interpret the listed versions.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@SECURITY.md`:
- Around line 15-16: Replace the fragile relative advisories link with the
repository's absolute GitHub security advisories URL: change the relative path
"[GitHub's private vulnerability reporting](../../security/advisories/new)" in
SECURITY.md to the full URL
"https://github.com/petry-projects/markets/security/advisories/new" so reporters
always reach the correct private reporting page; keep the email address intact
and ensure the Markdown link text remains unchanged.
---
Nitpick comments:
In `@SECURITY.md`:
- Around line 5-8: Replace the ambiguous table entry "latest" in the Version
column with explicit supported version identifiers or a named branch (e.g.,
"v1.2.x, v1.3.x" or "main") and update any adjacent text to describe the support
policy; specifically edit the table row that currently reads "| latest |
:white_check_mark: |" so it lists concrete version strings or a clear channel
name and, if needed, add a short note under the table explaining the support
window/criteria and how to interpret the listed versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| Instead, please send an email to **security@petry-projects.dev** or use | ||
| [GitHub's private vulnerability reporting](../../security/advisories/new). |
There was a problem hiding this comment.
Use an absolute GitHub advisories URL to avoid broken reporting flow.
../../security/advisories/new is a fragile relative path for a security-reporting entry point. Please use the full repo URL (for example, https://github.com/petry-projects/markets/security/advisories/new) so reporters always land on the correct private reporting page.
As per coding guidelines, “Focus on Markdown best practices, clear and consistent formatting, correct link references, and accurate technical documentation. Flag broken links, inconsistent heading levels, and unclear instructions.”
🧰 Tools
🪛 LanguageTool
[style] ~15-~15: Consider using “email”.
Context: ...ity vulnerabilities.** Instead, please send an email to security@petry-projects.dev or use ...
(SEND_AN_EMAIL)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@SECURITY.md` around lines 15 - 16, Replace the fragile relative advisories
link with the repository's absolute GitHub security advisories URL: change the
relative path "[GitHub's private vulnerability
reporting](../../security/advisories/new)" in SECURITY.md to the full URL
"https://github.com/petry-projects/markets/security/advisories/new" so reporters
always reach the correct private reporting page; keep the email address intact
and ensure the Markdown link text remains unchanged.
|
Summary
Closes #15, #16, #17, #18, #19
Test plan
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com
Summary by CodeRabbit
Documentation
Chores