chore: add CI workflow and SECURITY.md - #23
Conversation
|
PR Summary by QodoAdd GitHub Actions CI (Node 20) and SECURITY.md policy
AI Description
Diagram
High-Level Assessment
Files changed (2)
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new SECURITY.md file to establish the repository's security policy, detailing supported versions and instructions for reporting vulnerabilities. The feedback suggests enhancing the reporting section by providing a direct relative link to the GitHub Security Advisory creation page for a better user experience.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| Please report security vulnerabilities through the repository's security advisory. | ||
| Do not open public issues for security defects. |
There was a problem hiding this comment.
To make it easier for security researchers and users to report vulnerabilities, consider providing a direct relative link to the repository's security advisory creation page. This allows users to click directly through to the private reporting form on GitHub without having to manually navigate the repository's tabs.
| Please report security vulnerabilities through the repository's security advisory. | |
| Do not open public issues for security defects. | |
| Please report security vulnerabilities through the repository's [Security Advisory](../../security/advisories/new). | |
| Do not open public issues for security defects. |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR adds CI infrastructure and security documentation, but requires critical security fixes before merge.
Critical Changes Required:
- CI Security: Pin GitHub Actions to commit SHAs to prevent supply chain attacks (CWE-1357)
- Resource Protection: Add job timeout to prevent runaway workflows
- Security Documentation: Replace vague "main" branch reference with specific version numbers and provide actionable vulnerability reporting instructions
The redundant working-directory configuration should also be removed for cleaner workflow definition.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-node@v4 |
There was a problem hiding this comment.
🛑 Security Vulnerability: GitHub Actions should be pinned to full-length commit SHAs instead of tags to prevent supply chain attacks. Mutable tags can be redirected to malicious code.1
Pin actions/checkout and actions/setup-node to their specific commit SHAs.
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 |
Footnotes
-
CWE-1357: Reliance on Insufficiently Trustworthy Component - https://cwe.mitre.org/data/definitions/1357.html ↩
| build: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
Add a timeout to prevent workflows from consuming excessive resources if they hang. Without a timeout, jobs can run up to the maximum limit (6 hours for GitHub-hosted runners).
| build: | |
| runs-on: ubuntu-latest | |
| build: | |
| timeout-minutes: 10 | |
| runs-on: ubuntu-latest |
| build: | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: . | ||
| steps: |
There was a problem hiding this comment.
Remove redundant working-directory configuration. The default working directory is already the repository root (.), making this explicit setting unnecessary.
| build: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: . | |
| steps: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: |
| | Version | Supported | | ||
| | ------- | ------------------ | | ||
| | main | :white_check_mark: | |
There was a problem hiding this comment.
Replace vague "main" branch reference with specific semantic version numbers. Users need to know which released versions receive security support, not which branch is active.
| | Version | Supported | | |
| | ------- | ------------------ | | |
| | main | :white_check_mark: | | |
| | Version | Supported | | |
| | ------- | ------------------ | | |
| | 1.x | :white_check_mark: | | |
| | < 1.0 | :x: | |
| Please report security vulnerabilities through the repository's security advisory. | ||
| Do not open public issues for security defects. |
There was a problem hiding this comment.
Provide a specific contact method or link for reporting vulnerabilities. The current instruction lacks actionable information about where to find the security advisory feature.
| Please report security vulnerabilities through the repository's security advisory. | |
| Do not open public issues for security defects. | |
| Please report security vulnerabilities through GitHub's Security Advisories at: | |
| Do not open public issues for security defects. |
Code Review by Qodo
1. npm ci missing lockfile
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| cache: npm | ||
| - run: npm ci | ||
| - run: npm run -s build |
There was a problem hiding this comment.
1. Npm ci missing lockfile 🐞 Bug ≡ Correctness
The workflow runs npm ci, which requires a committed npm lockfile; without package-lock.json/npm-shrinkwrap.json, the CI job will fail during dependency installation. This prevents build/tests from running at all on PRs and pushes.
Agent Prompt
## Issue description
`.github/workflows/ci.yml` runs `npm ci`, but the repo does not include an npm lockfile. `npm ci` errors when `package-lock.json` / `npm-shrinkwrap.json` is missing.
## Issue Context
The repo’s docs show `npm install` for local setup, and the workflow expects a deterministic install (`npm ci`).
## Fix Focus Areas
- .github/workflows/ci.yml[18-21]
## Suggested fix
Choose one:
1) Preferred (deterministic CI): generate and commit `package-lock.json` (run `npm install` once, commit the lockfile) and keep `npm ci`.
2) If you intentionally don’t want a lockfile: change the workflow install step to `npm install` (and consider removing `cache: npm` since setup-node’s npm caching relies on a lockfile).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: |
There was a problem hiding this comment.
2. Unpinned action references 🐞 Bug ⛨ Security
The workflow uses floating major-version tags for GitHub Actions, so the executed code can change without a PR in this repo. This weakens CI supply-chain integrity compared to pinning to full commit SHAs.
Agent Prompt
## Issue description
The workflow references actions by major tags (e.g. `actions/checkout@v4`). Tags intentionally move forward, meaning your CI behavior can change without any repo change.
## Issue Context
Pinning to a commit SHA improves supply-chain integrity and reproducibility.
## Fix Focus Areas
- .github/workflows/ci.yml[14-16]
## Suggested fix
Replace tag refs with full SHAs, e.g.
- `uses: actions/checkout@<full_sha>`
- `uses: actions/setup-node@<full_sha>`
Optionally keep a comment indicating the corresponding version (v4.x.y) for maintainability.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| branches: [main] | ||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
3. Runner image not pinned 🐞 Bug ☼ Reliability
Using ubuntu-latest makes CI environment changes implicit as GitHub updates the alias, which can introduce unexpected build/test differences over time. Pinning a specific Ubuntu version improves reproducibility.
Agent Prompt
## Issue description
`runs-on: ubuntu-latest` can change the OS image under your workflow over time.
## Issue Context
Pinning reduces CI drift and makes failures easier to reproduce.
## Fix Focus Areas
- .github/workflows/ci.yml[8-10]
## Suggested fix
Change to a pinned runner label, e.g. `runs-on: ubuntu-24.04` (or `ubuntu-22.04` if you prefer the older LTS).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2bbc1a7875
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| with: | ||
| node-version: 20.x | ||
| cache: npm | ||
| - run: npm ci |
There was a problem hiding this comment.
In the workflow as added, every push/PR job fails at this step because the repository has package.json but no package-lock.json or npm-shrinkwrap.json (confirmed with repo-wide file listing). I also checked npm ci --dry-run, which reports that npm ci can only install with an existing lockfile, so CI cannot reach the build or test steps until either a lockfile is committed or this uses an install command that can generate one.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
Adds baseline repository governance and automation by introducing a Security Policy and a GitHub Actions CI workflow aligned to the project’s Node 20 requirement.
Changes:
- Added
SECURITY.mddocumenting supported versions and a vulnerability reporting process. - Added a GitHub Actions CI workflow that installs dependencies, builds, and runs tests on pushes/PRs to
main.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| SECURITY.md | Introduces a Security Policy and vulnerability reporting guidance. |
| .github/workflows/ci.yml | Adds a CI job that installs dependencies, builds, and runs the test suite on Node 20. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| with: | ||
| node-version: 20.x | ||
| cache: npm | ||
| - run: npm ci |
| name: CI | ||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| branches: [main] | ||
| jobs: |
|
|
||
| ## Reporting a Vulnerability | ||
|
|
||
| Please report security vulnerabilities through the repository's security advisory. |
|
Closing as superseded by #24, which bundles the CI workflow and SECURITY.md. Reopen if needed. |
Adds CI workflow pinned to Node 20 and a SECURITY.md file.