Every change passes a security scan before it lands - #5
Open
DeyangChan wants to merge 1 commit into
Open
Conversation
Installing this plugin runs its code on a stranger's machine, so the pipeline now proves more than that the tests pass. - CodeQL, Gitleaks over the full history, and a zizmor audit of the workflows themselves run on every pull request, on main, and weekly. A gates job fails unless all of them report success, so a skipped scan blocks a merge too. - A SonarQube Cloud scan runs where SONAR_TOKEN is set, and reports a skip rather than failing where it is not. - OpenSSF Scorecard runs weekly on main and publishes the score the README badge reads. - Every action is pinned by commit SHA with its version in a trailing comment, and Dependabot moves the pins weekly after a seven-day cooldown. SECURITY.md owns what each gate enforces; CONTRIBUTING.md and the pull request checklist say what a contributor has to do about it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # reviewer would run today, and there is no lockfile to pin it against. | ||
| - name: Install Claude Code | ||
| run: npm install --global @anthropic-ai/claude-code | ||
| run: npm install --global @anthropic-ai/claude-code # zizmor: ignore[adhoc-packages] |
| # reviewer would run today, and there is no lockfile to pin it against. | ||
| - name: Install Claude Code | ||
| run: npm install --global @anthropic-ai/claude-code | ||
| run: npm install --global @anthropic-ai/claude-code # zizmor: ignore[adhoc-packages] |
| set -euo pipefail | ||
| cd "$RUNNER_TEMP" | ||
| release="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}" | ||
| curl -fsSL -O "${release}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" |
| cd "$RUNNER_TEMP" | ||
| release="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}" | ||
| curl -fsSL -O "${release}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | ||
| curl -fsSL -O "${release}/gitleaks_${GITLEAKS_VERSION}_checksums.txt" |
| - cron: '23 5 * * 1' | ||
|
|
||
| permissions: | ||
| contents: read |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Installing this plugin runs its code on a stranger's machine, so the pipeline now proves more than that the tests pass.
.github/workflows/security.ymladds four scans, on every pull request, on every push tomain, and weekly:security-and-qualityrunblockA
Security gatesjob depends on all four and fails unless each one reportssuccess, so a skipped or cancelled scan blocks a merge the same way a failing one does..github/workflows/scorecard.ymlruns OpenSSF Scorecard weekly and onmain, and publishes the score the README badge reads.Supply chain:
.github/dependabot.ymlmoves those pins weekly, after a seven-day cooldown so a freshly compromised release is not picked up on publication day.zizmor: ignorewith the reason beside it: that job has to run the validator a marketplace reviewer would run today.Documentation follows the existing split.
SECURITY.mdowns what each gate enforces and the pinning rule.CONTRIBUTING.mdsays how to run two of the scans locally.CLAUDE.mdand the pull request checklist reference them.The SonarQube job skips itself where
SONAR_TOKENis not set, which is the case until the project is imported on SonarQube Cloud, and on every pull request from a fork. Its badges are held out of the README until then.How it was tested
No skill or plugin asset changed, so there was nothing to drive end to end. What was run locally:
gitleaks git --no-banner --redact --verbose— 85 commits scanned, no leaks.uvx zizmor@1.29.0 .github/workflows/ .github/dependabot.yml, offline and with online audits — no findings. Both findings from the first run were addressed rather than silenced, apart from the documented ad-hoc install.build-shell.mjs check— all pass.Checklist
lib/workdir.mjsand lands under.vstack/local/<tool>/.lib/shell/rather than a stamped region — n/a, no page changed🤖 Generated with Claude Code