chore(standards): synced file(s) with hallelx2/dev-standards - #4
Open
hallelx2 wants to merge 10 commits into
Open
chore(standards): synced file(s) with hallelx2/dev-standards#4hallelx2 wants to merge 10 commits into
hallelx2 wants to merge 10 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Reviewer's GuideAdds synced dev-standards documentation, AI reviewer agent configs, path-scoped review instructions, and reusable security/Jules review GitHub Actions workflows to align this repo with the centralized dev-standards configuration. Sequence diagram for jules-review GitHub Action executionsequenceDiagram
actor Dev
participant Repo
participant GitHub_Actions
participant Jules_Workflow as jules-review
participant Guard_Step as guard
participant Jules_Action as sanjay3290/jules-pr-reviewer
Dev->>Repo: open/synchronize PR
Repo->>GitHub_Actions: pull_request event
GitHub_Actions->>Jules_Workflow: start workflow
Jules_Workflow->>Guard_Step: run guard step
alt JULES_API_KEY set
Guard_Step-->>Jules_Workflow: enabled=true
Jules_Workflow->>Jules_Action: run jules-pr-reviewer
else JULES_API_KEY not set
Guard_Step-->>Jules_Workflow: enabled=false
Jules_Workflow-->>Dev: log skip message
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
📝 WalkthroughWalkthroughRepository review standards, specialized agent instructions, Dependabot configuration, and reusable security workflows were added. Automation covers pull-request security reviews, secret scanning, SAST, vulnerability checks, and filesystem scanning. ChangesReview and Security Standards
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- In
.github/workflows/security.reusable.yml, consider pinning third-party actions likeaquasecurity/trivy-action@0.28.0andgitleaks/gitleaks-action@v2to specific commit SHAs rather than tags to reduce supply-chain risk from upstream tag moves. - In
.github/workflows/jules-review.yml, you may want to restrict the trigger (e.g.,pull_requesttypes or paths) if you expect Jules to run only on certain PRs, to avoid unnecessary runs/noise on trivial or non-code changes.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `.github/workflows/security.reusable.yml`, consider pinning third-party actions like `aquasecurity/trivy-action@0.28.0` and `gitleaks/gitleaks-action@v2` to specific commit SHAs rather than tags to reduce supply-chain risk from upstream tag moves.
- In `.github/workflows/jules-review.yml`, you may want to restrict the trigger (e.g., `pull_request` types or paths) if you expect Jules to run only on certain PRs, to avoid unnecessary runs/noise on trivial or non-code changes.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
There was a problem hiding this comment.
Pull request overview
This PR syncs shared engineering/AI-agent standards and security-related GitHub Actions workflows from hallelx2/dev-standards into vectorless-docs to standardize review guidance and baseline security scanning across repositories.
Changes:
- Add
AGENTS.mdplus Copilot/agent instruction files to standardize AI-assisted review expectations (backend/frontend/security/test reliability). - Add path-scoped review rubrics under
.github/instructions/to auto-apply guidance by file type. - Add security scanning workflows (gitleaks/Trivy/gosec) and an optional Jules-based PR security review workflow.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| AGENTS.md | Adds shared engineering/review standards and Vectorless-specific security priorities. |
| .github/copilot-instructions.md | Defines baseline Copilot PR review rubric (right thing / done right / safe). |
| .github/agents/backend-reviewer.agent.md | Adds a specialized Go backend review agent prompt. |
| .github/agents/frontend-reviewer.agent.md | Adds a specialized Next.js/TypeScript review agent prompt. |
| .github/agents/security-reviewer.agent.md | Adds an adversarial security review agent prompt focused on OWASP + multi-tenant/BYOK. |
| .github/agents/test-reliability-reviewer.agent.md | Adds a test reliability agent prompt focusing on determinism and proof of behavior. |
| .github/instructions/backend.instructions.md | Path-scoped Go review rubric (**/*.go). |
| .github/instructions/frontend.instructions.md | Path-scoped TS/TSX/CSS review rubric (frontend focus). |
| .github/instructions/security.instructions.md | Global security review rubric applied to all changes. |
| .github/workflows/security.yml | Adds caller workflow to run the reusable security scanners on PRs and main pushes. |
| .github/workflows/security.reusable.yml | Adds reusable security scanners (gitleaks, Trivy FS scan, conditional gosec). |
| .github/workflows/jules-review.yml | Adds optional automated Jules security review workflow gated by JULES_API_KEY. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+21
to
+22
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
Comment on lines
+52
to
+56
| - name: gosec | ||
| if: steps.detect.outputs.is_go == 'true' | ||
| uses: securego/gosec@master | ||
| with: | ||
| args: -no-fail -fmt text ./... |
Comment on lines
+21
to
+32
| - name: Guard — only run when a Jules key is configured | ||
| id: guard | ||
| run: | | ||
| if [ -n "${{ secrets.JULES_API_KEY }}" ]; then | ||
| echo "enabled=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "enabled=false" >> "$GITHUB_OUTPUT" | ||
| echo "No JULES_API_KEY set — skipping automated Jules review. Use @jules on the PR instead." | ||
| fi | ||
| - name: Jules security review | ||
| if: steps.guard.outputs.enabled == 'true' | ||
| uses: sanjay3290/jules-pr-reviewer@main |
Comment on lines
+30
to
+35
| - name: Jules security review | ||
| if: steps.guard.outputs.enabled == 'true' | ||
| uses: sanjay3290/jules-pr-reviewer@main | ||
| with: | ||
| jules-api-key: ${{ secrets.JULES_API_KEY }} | ||
| github-token: ${{ github.token }} |
Comment on lines
+1
to
+3
| --- | ||
| applyTo: "**/*.ts,**/*.tsx,**/*.css" | ||
| --- |
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
June 13, 2026 02:13
54520f6 to
7cdd707
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
June 13, 2026 02:20
7cdd707 to
3a777e0
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
June 13, 2026 02:47
3a777e0 to
c72f6eb
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
June 13, 2026 02:48
c72f6eb to
c77e57b
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
June 13, 2026 07:33
c77e57b to
8c52c86
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
June 13, 2026 08:04
8c52c86 to
9d4566c
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
June 15, 2026 11:50
9d4566c to
c101885
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
June 22, 2026 11:39
c101885 to
73040a3
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
June 29, 2026 10:27
73040a3 to
b2ce633
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
July 6, 2026 07:29
b2ce633 to
1c91c53
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # Local reference — the reusable file is synced into THIS repo too, so each repo | ||
| # is self-contained and this works whether dev-standards is public or private. | ||
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install Trivy (latest binary — avoids the action's broken setup-trivy pin) | ||
| run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin |
| name: Vulns + misconfig (Trivy) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| id: detect | ||
| run: | | ||
| if ls requirements*.txt pyproject.toml setup.py >/dev/null 2>&1; then echo "is_py=true" >> "$GITHUB_OUTPUT"; else echo "is_py=false" >> "$GITHUB_OUTPUT"; fi | ||
| - uses: actions/setup-python@v5 |
| name: Python deps + SAST (pip-audit + bandit) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - uses: gitleaks/gitleaks-action@v2 |
| name: Secrets (gitleaks) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
Comment on lines
+19
to
+24
| - package-ecosystem: npm | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
Comment on lines
+12
to
+17
| - package-ecosystem: gomod | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
Comment on lines
+6
to
+10
| - package-ecosystem: github-actions | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| labels: [dependencies, security] |
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
July 9, 2026 14:03
1c91c53 to
eec4f90
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
July 9, 2026 14:04
eec4f90 to
e1d15c6
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
July 13, 2026 08:53
e1d15c6 to
3b137f7
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/jules-review.yml (1)
24-28: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPass
JULES_API_KEYvia env instead of interpolating into the shell script.
${{ secrets.JULES_API_KEY }}is interpolated directly into the script text before the shell executes. If the secret contains shell metacharacters (",$, backticks), the script can break or behave unexpectedly. Use an environment variable to keep the value out of the script body.Proposed fix
- name: Guard — only run when a Jules key is configured id: guard + env: + JULES_API_KEY: ${{ secrets.JULES_API_KEY }} run: | - if [ -n "${{ secrets.JULES_API_KEY }}" ]; then + if [ -n "$JULES_API_KEY" ]; then echo "enabled=true" >> "$GITHUB_OUTPUT" else echo "enabled=false" >> "$GITHUB_OUTPUT" echo "No JULES_API_KEY set — skipping automated Jules review. Use `@jules` on the PR instead." fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/jules-review.yml around lines 24 - 28, Update the Jules API key check in the workflow step to read JULES_API_KEY from the step environment rather than interpolating secrets.JULES_API_KEY directly into the shell script. Preserve the existing enabled/disabled outputs and skip message while configuring the environment mapping for the secret..github/workflows/security.reusable.yml (1)
22-24: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSet
persist-credentials: falseon all checkout steps.
actions/checkoutpersists the GitHub token in.git/configby default. If a compromised scanner reads the workspace, it can extract the token. No subsequent step in any job needs git credentials, sopersist-credentials: falseis safe.Proposed fix
For the
secret-scanjob (which also setsfetch-depth: 0):- uses: actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: falseFor all other checkout steps (no existing
withblock):- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 + with: + persist-credentials: falseAlso applies to: 35-35, 58-58, 77-77, 92-92, 111-111, 131-131
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/security.reusable.yml around lines 22 - 24, Update every actions/checkout@v4 step in the workflow, including the secret-scan checkout with fetch-depth: 0, to set persist-credentials to false in its with block. Preserve each checkout’s existing options and add the setting to all referenced checkout steps.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security.reusable.yml:
- Line 33: Pin the Semgrep container image in the workflow’s image configuration
to an explicit immutable version tag or, preferably, a digest instead of the
floating semgrep/semgrep default. Preserve the existing Semgrep execution
behavior while ensuring every CI run uses the same trusted image.
In `@AGENTS.md`:
- Line 12: Update the validation guidance in AGENTS.md so the “Done” requirement
explicitly includes repository-appropriate build, test, and lint commands, not
typechecking alone. Extend the Go commands to include go test -race where
applicable, and add explicit TypeScript test and lint commands alongside the
existing build examples.
---
Nitpick comments:
In @.github/workflows/jules-review.yml:
- Around line 24-28: Update the Jules API key check in the workflow step to read
JULES_API_KEY from the step environment rather than interpolating
secrets.JULES_API_KEY directly into the shell script. Preserve the existing
enabled/disabled outputs and skip message while configuring the environment
mapping for the secret.
In @.github/workflows/security.reusable.yml:
- Around line 22-24: Update every actions/checkout@v4 step in the workflow,
including the secret-scan checkout with fetch-depth: 0, to set
persist-credentials to false in its with block. Preserve each checkout’s
existing options and add the setting to all referenced checkout steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9dddf1c9-6918-4666-9942-01668aaf0b03
📒 Files selected for processing (13)
.github/agents/backend-reviewer.agent.md.github/agents/frontend-reviewer.agent.md.github/agents/security-reviewer.agent.md.github/agents/test-reliability-reviewer.agent.md.github/copilot-instructions.md.github/dependabot.yml.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.md.github/instructions/security.instructions.md.github/workflows/jules-review.yml.github/workflows/security.reusable.yml.github/workflows/security.ymlAGENTS.md
| name: SAST — OWASP Top 10 + CWE Top 25 (Semgrep) | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: semgrep/semgrep |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin the Semgrep container image to a specific version or digest.
image: semgrep/semgrep pulls the latest tag by default. If a compromised or broken image is pushed, it affects every CI run that uses this workflow. Pin to a specific version tag or, ideally, a digest.
Proposed fix
container:
- image: semgrep/semgrep
+ image: semgrep/semgrep:1.75.0Or pin by digest for maximum reproducibility:
container:
- image: semgrep/semgrep
+ image: semgrep/semgrep@sha256:<digest>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| image: semgrep/semgrep | |
| image: semgrep/semgrep:1.75.0 |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 33-33: unpinned image references (unpinned-images): container image is unpinned
(unpinned-images)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml at line 33, Pin the Semgrep
container image in the workflow’s image configuration to an explicit immutable
version tag or, preferably, a digest instead of the floating semgrep/semgrep
default. Preserve the existing Semgrep execution behavior while ensuring every
CI run uses the same trusted image.
Source: Linters/SAST tools
| - **One issue → one branch → one PR → one outcome.** Use the Linear branch name (`halleluyaholudele/hal-<n>-<title>`). Never commit to `main` directly. | ||
| - Put **`Closes HAL-<n>`** in the **PR description** so Linear links + auto-closes on merge. | ||
| - **No AI attribution** in commits, PRs, or any artifact. Author as the user alone. | ||
| - "Done" = real build + tests + lint pass (run them — `go build ./... && go test ./...`, `bun run build` / `npm run build`), not just typecheck. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Make the required validation commands complete.
Line 12 requires build, tests, and lint, but the examples show only build for TypeScript and omit go test -race, despite the Go concurrency requirement on Line 24. Add explicit repository-appropriate test/lint commands and the race check where applicable.
Based on learnings: a change is done only after the real build, tests, and lint pass; do not rely on typechecking alone.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 12, Update the validation guidance in AGENTS.md so the
“Done” requirement explicitly includes repository-appropriate build, test, and
lint commands, not typechecking alone. Extend the Go commands to include go test
-race where applicable, and add explicit TypeScript test and lint commands
alongside the existing build examples.
Source: Learnings
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
July 20, 2026 08:44
3b137f7 to
81d8ac1
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
July 27, 2026 09:35
81d8ac1 to
aa5dff3
Compare
added 10 commits
August 3, 2026 09:27
Synced AI-review standards from hallelx2/dev-standards.
…m remote '.github/copilot-instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…b/agents/' Synced AI-review standards from hallelx2/dev-standards.
…tions.md' from remote '.github/instructions/backend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/frontend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/security.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
… remote '.github/workflows/security.yml' Synced AI-review standards from hallelx2/dev-standards.
…yml' from remote '.github/workflows/security.reusable.yml' Synced AI-review standards from hallelx2/dev-standards.
…from remote '.github/workflows/jules-review.yml' Synced AI-review standards from hallelx2/dev-standards.
…'.github/dependabot.yml' Synced AI-review standards from hallelx2/dev-standards.
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
August 3, 2026 09:27
aa5dff3 to
e6ea92b
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security.reusable.yml:
- Around line 37-52: Update .github/workflows/security.reusable.yml lines 37-52
to remove Semgrep’s error-swallowing behavior and make SARIF upload failures
fail the job; preserve govulncheck failures at lines 69-71, define an explicit
failure policy for gosec at lines 82-86, preserve npm audit failures at lines
103-105 and pip-audit/Bandit failures at lines 120-125, and make high/critical
Trivy findings actionable at lines 132-135. Do not weaken any scanner or upload
failure controls.
- Around line 22-24: Disable persisted checkout credentials by setting
persist-credentials to false on every actions/checkout step in
.github/workflows/security.reusable.yml: lines 22-24 (secret-scan), 35
(sast-semgrep), 58 (go-cves), 77 (go-sast), 92 (node-cves), 111 (python-sast),
and 131 (infra-trivy).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bfed3064-4acb-4abb-82ff-4a5644537f7e
📒 Files selected for processing (13)
.github/agents/backend-reviewer.agent.md.github/agents/frontend-reviewer.agent.md.github/agents/security-reviewer.agent.md.github/agents/test-reliability-reviewer.agent.md.github/copilot-instructions.md.github/dependabot.yml.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.md.github/instructions/security.instructions.md.github/workflows/jules-review.yml.github/workflows/security.reusable.yml.github/workflows/security.ymlAGENTS.md
🚧 Files skipped from review as they are similar to previous changes (8)
- .github/agents/backend-reviewer.agent.md
- .github/agents/frontend-reviewer.agent.md
- .github/agents/security-reviewer.agent.md
- .github/instructions/backend.instructions.md
- .github/instructions/frontend.instructions.md
- .github/agents/test-reliability-reviewer.agent.md
- .github/instructions/security.instructions.md
- .github/workflows/jules-review.yml
Comment on lines
+22
to
+24
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -A3 -B1 'uses:\s*actions/checkout@|persist-credentials:' .github/workflows/security.reusable.ymlRepository: hallelx2/vectorless-docs
Length of output: 1300
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
cat -n .github/workflows/security.reusable.yml | sed -n '1,155p'Repository: hallelx2/vectorless-docs
Length of output: 5981
Disable persisted checkout credentials.
actions/checkout@v4 persists the GitHub token in the local Git config by default. Set persist-credentials: false on every checkout before later installers can access those credentials.
.github/workflows/security.reusable.yml#L22-L24: disable credential persistence forsecret-scan..github/workflows/security.reusable.yml#L35-L35: disable credential persistence forsast-semgrep..github/workflows/security.reusable.yml#L58-L58: disable credential persistence forgo-cves..github/workflows/security.reusable.yml#L77-L77: disable credential persistence forgo-sast..github/workflows/security.reusable.yml#L92-L92: disable credential persistence fornode-cves..github/workflows/security.reusable.yml#L111-L111: disable credential persistence forpython-sast..github/workflows/security.reusable.yml#L131-L131: disable credential persistence forinfra-trivy.
🧰 Tools
🪛 GitHub Check: Semgrep OSS
[warning] 22-22: Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🪛 zizmor (1.28.0)
[warning] 22-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/security.reusable.yml#L22-L24(this comment).github/workflows/security.reusable.yml#L35-L35.github/workflows/security.reusable.yml#L58-L58.github/workflows/security.reusable.yml#L77-L77.github/workflows/security.reusable.yml#L92-L92.github/workflows/security.reusable.yml#L111-L111.github/workflows/security.reusable.yml#L131-L131
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml around lines 22 - 24, Disable
persisted checkout credentials by setting persist-credentials to false on every
actions/checkout step in .github/workflows/security.reusable.yml: lines 22-24
(secret-scan), 35 (sast-semgrep), 58 (go-cves), 77 (go-sast), 92 (node-cves),
111 (python-sast), and 131 (infra-trivy).
Sources: Coding guidelines, Linters/SAST tools
Comment on lines
+37
to
+52
| run: | | ||
| semgrep scan \ | ||
| --config p/owasp-top-ten \ | ||
| --config p/cwe-top-25 \ | ||
| --config p/secrets \ | ||
| --config p/javascript \ | ||
| --config p/typescript \ | ||
| --config p/python \ | ||
| --config p/github-actions \ | ||
| --sarif --output semgrep.sarif || true | ||
| - name: Upload Semgrep SARIF | ||
| if: always() | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: semgrep.sarif | ||
| continue-on-error: true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Fail when a security scanner cannot produce a reliable result.
|| true, continue-on-error: true, -no-fail, and --exit-code 0 allow this workflow to complete successfully after scanner failures or confirmed findings. Keep advisory findings separate if needed, but fail the job when a scanner cannot run or upload its result.
.github/workflows/security.reusable.yml#L37-L52: preserve Semgrep and SARIF upload failures..github/workflows/security.reusable.yml#L69-L71: preservegovulncheckfailures..github/workflows/security.reusable.yml#L82-L86: define an explicit failure policy forgosec..github/workflows/security.reusable.yml#L103-L105: preservenpm auditfailures..github/workflows/security.reusable.yml#L120-L125: preservepip-auditand Bandit failures..github/workflows/security.reusable.yml#L132-L135: make high and critical Trivy findings actionable.
As per coding guidelines, do not weaken security controls by swallowing errors.
🧰 Tools
🪛 GitHub Check: Semgrep OSS
[warning] 49-49: Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
📍 Affects 1 file
.github/workflows/security.reusable.yml#L37-L52(this comment).github/workflows/security.reusable.yml#L69-L71.github/workflows/security.reusable.yml#L82-L86.github/workflows/security.reusable.yml#L103-L105.github/workflows/security.reusable.yml#L120-L125.github/workflows/security.reusable.yml#L132-L135
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml around lines 37 - 52, Update
.github/workflows/security.reusable.yml lines 37-52 to remove Semgrep’s
error-swallowing behavior and make SARIF upload failures fail the job; preserve
govulncheck failures at lines 69-71, define an explicit failure policy for gosec
at lines 82-86, preserve npm audit failures at lines 103-105 and
pip-audit/Bandit failures at lines 120-125, and make high/critical Trivy
findings actionable at lines 132-135. Do not weaken any scanner or upload
failure controls.
Source: Coding guidelines
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
synced local file(s) with hallelx2/dev-standards.
Changed files
AGENTS.mdfrom remoteAGENTS.md.github/copilot-instructions.mdfrom remote.github/copilot-instructions.md.github/agents/and copied all sub files/folders from remote directory.github/agents/.github/instructions/backend.instructions.mdfrom remote.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.mdfrom remote.github/instructions/frontend.instructions.md.github/instructions/security.instructions.mdfrom remote.github/instructions/security.instructions.md.github/workflows/security.ymlfrom remote.github/workflows/security.yml.github/workflows/security.reusable.ymlfrom remote.github/workflows/security.reusable.yml.github/workflows/jules-review.ymlfrom remote.github/workflows/jules-review.yml.github/dependabot.ymlfrom remote.github/dependabot.ymlThis PR was created automatically by the repo-file-sync-action workflow run #30801469164
Summary by CodeRabbit
New Features
Chores