chore: harden GitHub collaboration and security automation - #5
Conversation
Reviewer's GuideHardens GitHub collaboration and security automation by adding ownership and reliability review guidance, weekly Dependabot coverage for npm and Actions, and least-privilege CodeQL analysis for JavaScript/TypeScript changes. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/codeql.yml" line_range="22" />
<code_context>
+ timeout-minutes: 15
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+
+ - name: Initialize CodeQL
</code_context>
<issue_to_address>
**🚨 issue (security):** The CodeQL workflow executes mutable major-version tags for checkout and both CodeQL actions, so a tag movement or compromised release runs unreviewed action code with `security-events: write` permission.
**Triggers:** When one of the referenced major tags is retagged or its upstream release is compromised.
**Suggested fix:** Pin each action to a reviewed commit SHA and let Dependabot update the SHA references.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and a mistaken CODEOWNERS policy could block required reviews or let changes proceed under the wrong ownership, while a faulty CodeQL workflow could disable or misconfigure security scanning or fail CI. Reverting restores the prior repository behavior, but merges made or scans missed while the change was active would need separate review or remediation.
Blocking findings: .github/workflows/codeql.yml:22
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| timeout-minutes: 15 | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🚨 issue (security): The CodeQL workflow executes mutable major-version tags for checkout and both CodeQL actions, so a tag movement or compromised release runs unreviewed action code with security-events: write permission.
Triggers: When one of the referenced major tags is retagged or its upstream release is compromised.
Suggested fix: Pin each action to a reviewed commit SHA and let Dependabot update the SHA references.
Adds ownership rules, a reliability-focused PR checklist, Dependabot coverage for npm and GitHub Actions, and CodeQL analysis for the TypeScript runtime. Existing issue forms are preserved.
Summary by Sourcery
Harden repository collaboration and security automation with ownership guidance, reliability checks, dependency updates, and CodeQL scanning.
Enhancements:
CI: