chore: add Dependabot configuration and critical-vuln gate - #136
Conversation
📝 WalkthroughSummary
Risk: Security-sensitive areas: Reusable workflows pinned to Test coverage impact: No application code or tests changed. Workflow syntax, permissions, secret availability, reusable-workflow compatibility, and branch-protection behavior require validation in GitHub. Operational concerns: Dependabot runs weekly on Tuesdays at 06:00 Asia/Amman. The critical check only blocks merges where configured as required, particularly on WalkthroughAdds weekly Dependabot updates for npm, Docker, and GitHub Actions, plus pull request workflows that run a reusable vulnerability gate and auto-merge eligible Dependabot patch updates. ChangesDependency Automation
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/critical-vuln-check.yml:
- Around line 30-32: Update the workflow permissions block near the
vulnerability check configuration to remove the unnecessary contents write
access and use contents read instead, or remove that scope if the reusable
workflow critical-vuln-gate.yml declares its own permissions. Keep
security-events read and ensure the workflow retains only permissions required
for its read-only Dependabot alert check.
- Line 36: Update the reusable workflow reference in the critical vulnerability
gate job to use a full immutable commit SHA instead of the mutable `@main` branch
reference, preserving the existing simplify9/.github workflow path and
configuration.
In @.github/workflows/dependabot-auto-merge.yml:
- Line 35: Pin both GitHub Actions references to immutable commit SHAs: update
the reusable workflow reference at `critical-vuln-gate.yml` and the
`dependabot/fetch-metadata` action from their mutable `@main`/`@v2` references,
preserving the existing workflow behavior.
- Around line 58-61: Update the auto-merge step’s notice command to read
package-ecosystem through an environment variable, following the existing PR_URL
pattern, and configure that variable from the validated metadata output.
Preserve the allowlist condition and current notice and merge behavior.
- Around line 23-25: Add a workflow-level concurrency configuration near the
existing on declaration in the Dependabot auto-merge workflow, using a group
keyed to the pull request or workflow context and enabling cancellation of
in-progress runs so superseded commits stop older executions.
- Around line 27-30: Move the workflow-level permissions into the corresponding
job definitions: give auto-merge only pull-requests: write and contents: write,
and give vuln-gate only security-events: read. Remove the global permissions
block so vuln-gate does not inherit contents: write or pull-requests: write,
while preserving each job’s required access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: simplify9/coderabbit/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 54ae5dfb-8943-4f91-8aab-a8b0cc02debe
📒 Files selected for processing (3)
.github/dependabot.yml.github/workflows/critical-vuln-check.yml.github/workflows/dependabot-auto-merge.yml
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: vuln-check-136 / vuln-gate _ check: vuln-check-136
Conclusion: failure
�[36;1mecho "::group::🔒 [CHECKPOINT 1/1] Query Open Critical Dependabot Alerts"�[0m
�[36;1m�[0m
�[36;1mif [[ -z "$DEPENDABOT_TOKEN" ]]; then�[0m
�[36;1m echo "::error title=❌ [VULN-GATE] Missing dependabot-alerts-***REDACTED*** — this gate requires a PAT/App token with 'Dependabot alerts: read', forwarded explicitly by the caller (GITHUB_TOKEN cannot access this API regardless of granted permissions). Add a dependabot-alerts-token entry (set to the DEPENDABOT_ALERTS_TOKEN org secret) to this job's secrets block in the caller workflow. Fails closed until forwarded."�[0m
GitHub Actions: vuln-check-136 / 0_vuln-gate _ check.txt: vuln-check-136
Conclusion: failure
�[36;1mecho "::group::🔒 [CHECKPOINT 1/1] Query Open Critical Dependabot Alerts"�[0m
�[36;1m�[0m
�[36;1mif [[ -z "$DEPENDABOT_TOKEN" ]]; then�[0m
�[36;1m echo "::error title=❌ [VULN-GATE] Missing dependabot-alerts-***REDACTED*** — this gate requires a PAT/App token with 'Dependabot alerts: read', forwarded explicitly by the caller (GITHUB_TOKEN cannot access this API regardless of granted permissions). Add a dependabot-alerts-token entry (set to the DEPENDABOT_ALERTS_TOKEN org secret) to this job's secrets block in the caller workflow. Fails closed until forwarded."�[0m
🧰 Additional context used
📓 Path-based instructions (1)
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Treat GitHub Actions changes as supply-chain sensitive.Check for:
- Overbroad permissions
- Missing explicit permissions blocks
- Unpinned third-party actions
- Unsafe pull_request_target usage
- Secret exposure
- Shell injection risks
- Untrusted input used in scripts
- Dangerous artifact upload/download behavior
- Missing least-privilege permissions
Files:
.github/workflows/critical-vuln-check.yml.github/workflows/dependabot-auto-merge.yml
🪛 zizmor (1.26.1)
.github/workflows/critical-vuln-check.yml
[error] 31-31: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 31-31: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
.github/workflows/dependabot-auto-merge.yml
[error] 28-28: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
[error] 29-29: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[info] 60-60: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 35-35: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 47-47: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 28-28: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[error] 41-41: spoofable bot actor check (bot-conditions): actor context may be spoofable
(bot-conditions)
[info] 39-39: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 23-25: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🔇 Additional comments (1)
.github/dependabot.yml (1)
1-48: LGTM!
| permissions: | ||
| contents: write | ||
| security-events: read |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
contents: write is overly broad for a read-only vulnerability check.
This workflow only reads Dependabot alerts — it does not modify repository contents. The comment on lines 27–29 claims the caller must grant these scopes for the reusable workflow, but reusable workflows define their own permissions block independently of the caller. If critical-vuln-gate.yml specifies its own permissions, this block is unnecessary. If it doesn't, contents: write should still be contents: read since a vulnerability gate has no reason to write to the repo.
As per path instructions, check for overbroad permissions and missing least-privilege permissions.
🔒 Proposed fix
permissions:
- contents: write
+ contents: read
security-events: read📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: write | |
| security-events: read | |
| permissions: | |
| contents: read | |
| security-events: read |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 31-31: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[warning] 31-31: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/critical-vuln-check.yml around lines 30 - 32, Update the
workflow permissions block near the vulnerability check configuration to remove
the unnecessary contents write access and use contents read instead, or remove
that scope if the reusable workflow critical-vuln-gate.yml declares its own
permissions. Keep security-events read and ensure the workflow retains only
permissions required for its read-only Dependabot alert check.
Source: Path instructions
|
|
||
| jobs: | ||
| vuln-gate: | ||
| uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin the reusable workflow to a commit SHA, not @main.
A branch reference is mutable — if simplify9/.github is compromised or a bad commit lands on main, arbitrary code runs in this repository's CI with the granted permissions. Pin to an immutable SHA.
As per path instructions, treat GitHub Actions changes as supply-chain sensitive and check for unpinned third-party actions.
🔒 Proposed fix
- uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main
+ uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@<full-commit-sha>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main | |
| uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@<full-commit-sha> |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/critical-vuln-check.yml at line 36, Update the reusable
workflow reference in the critical vulnerability gate job to use a full
immutable commit SHA instead of the mutable `@main` branch reference, preserving
the existing simplify9/.github workflow path and configuration.
Source: Path instructions
| on: | ||
| pull_request: | ||
| branches: [main, develop] |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win
Add a concurrency group to cancel superseded runs.
Without concurrency settings, pushing multiple commits to the same Dependabot PR triggers overlapping workflow runs. A concurrency group cancels stale runs.
♻️ Proposed refactor
on:
pull_request:
branches: [main, develop]
+concurrency:
+ group: dependabot-auto-merge-${{ github.event.pull_request.number }}
+ cancel-in-progress: true
+
permissions:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on: | |
| pull_request: | |
| branches: [main, develop] | |
| on: | |
| pull_request: | |
| branches: [main, develop] | |
| concurrency: | |
| group: dependabot-auto-merge-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 23-25: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-auto-merge.yml around lines 23 - 25, Add a
workflow-level concurrency configuration near the existing on declaration in the
Dependabot auto-merge workflow, using a group keyed to the pull request or
workflow context and enabling cancellation of in-progress runs so superseded
commits stop older executions.
| permissions: | ||
| pull-requests: write | ||
| contents: write | ||
| security-events: read |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Scope permissions to job level to avoid granting contents: write to the vuln-gate job.
Workflow-level permissions apply to all jobs. The auto-merge job needs contents: write and pull-requests: write for gh pr merge, but the vuln-gate job does not — it calls a reusable workflow that should define its own permissions. security-events: read is only relevant to vuln-gate, not auto-merge. Move permissions to job level for least-privilege.
As per path instructions, check for overbroad permissions and missing least-privilege permissions.
🔒 Proposed fix
permissions:
- pull-requests: write
- contents: write
- security-events: read
+ contents: read
+
jobs:
vuln-gate:
if: ${{ github.actor == 'dependabot[bot]' }}
+ permissions:
+ security-events: read
uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main
secrets:
dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }}
auto-merge:
needs: vuln-gate
if: ${{ github.actor == 'dependabot[bot]' }}
runs-on: ubuntu-latest
+ permissions:
+ pull-requests: write
+ contents: write
timeout-minutes: 5📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| pull-requests: write | |
| contents: write | |
| security-events: read | |
| permissions: | |
| contents: read | |
| jobs: | |
| vuln-gate: | |
| if: ${{ github.actor == 'dependabot[bot]' }} | |
| permissions: | |
| security-events: read | |
| uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main | |
| secrets: | |
| dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }} | |
| auto-merge: | |
| needs: vuln-gate | |
| if: ${{ github.actor == 'dependabot[bot]' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: write | |
| contents: write | |
| timeout-minutes: 5 |
🧰 Tools
🪛 zizmor (1.26.1)
[error] 28-28: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
[error] 29-29: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[warning] 28-28: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-auto-merge.yml around lines 27 - 30, Move the
workflow-level permissions into the corresponding job definitions: give
auto-merge only pull-requests: write and contents: write, and give vuln-gate
only security-events: read. Remove the global permissions block so vuln-gate
does not inherit contents: write or pull-requests: write, while preserving each
job’s required access.
Source: Path instructions
| jobs: | ||
| vuln-gate: | ||
| if: ${{ github.actor == 'dependabot[bot]' }} | ||
| uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin both action references to commit SHAs.
Line 35 references the reusable workflow at @main — a mutable branch reference that executes arbitrary code if the upstream repo is compromised. Line 47 uses dependabot/fetch-metadata@v2 — a major version tag that can shift under you. Both should be pinned to immutable commit SHAs.
As per path instructions, treat GitHub Actions changes as supply-chain sensitive and check for unpinned third-party actions.
🔒 Proposed fix
- uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@main
+ uses: simplify9/.github/.github/workflows/critical-vuln-gate.yml@<full-commit-sha>- uses: dependabot/fetch-metadata@v2
+ uses: dependabot/fetch-metadata@<full-commit-sha>Also applies to: 47-47
🧰 Tools
🪛 zizmor (1.26.1)
[error] 35-35: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-auto-merge.yml at line 35, Pin both GitHub
Actions references to immutable commit SHAs: update the reusable workflow
reference at `critical-vuln-gate.yml` and the `dependabot/fetch-metadata` action
from their mutable `@main`/`@v2` references, preserving the existing workflow
behavior.
Source: Path instructions
| run: | | ||
| set -euo pipefail | ||
| echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} — patch-level ${{ steps.metadata.outputs.package-ecosystem }} bump, vuln gate passed" | ||
| gh pr merge --auto --squash "$PR_URL" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔵 Trivial | 💤 Low value
Pass package-ecosystem via environment variable instead of template expansion.
The if condition on lines 52–54 validates the value against an allowlist, so injection risk is mitigated. However, using an env variable is the consistent pattern already used for PR_URL on line 57.
♻️ Proposed refactor
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_URL: ${{ github.event.pull_request.html_url }}
+ ECOSYSTEM: ${{ steps.metadata.outputs.package-ecosystem }}
run: |
set -euo pipefail
- echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} — patch-level ${{ steps.metadata.outputs.package-ecosystem }} bump, vuln gate passed"
+ echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} — patch-level ${ECOSYSTEM} bump, vuln gate passed"
gh pr merge --auto --squash "$PR_URL"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| run: | | |
| set -euo pipefail | |
| echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} — patch-level ${{ steps.metadata.outputs.package-ecosystem }} bump, vuln gate passed" | |
| gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| ECOSYSTEM: ${{ steps.metadata.outputs.package-ecosystem }} | |
| run: | | |
| set -euo pipefail | |
| echo "::notice title=🤖 [AUTO-MERGE] Enabling auto-merge::${PR_URL} — patch-level ${ECOSYSTEM} bump, vuln gate passed" | |
| gh pr merge --auto --squash "$PR_URL" |
🧰 Tools
🪛 zizmor (1.26.1)
[info] 60-60: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-auto-merge.yml around lines 58 - 61, Update the
auto-merge step’s notice command to read package-ecosystem through an
environment variable, following the existing PR_URL pattern, and configure that
variable from the validated metadata output. Preserve the allowlist condition
and current notice and merge behavior.
Source: Path instructions
1 participant
Adds
.github/dependabot.yml(category:npm-frontend, target-branch:develop),.github/workflows/critical-vuln-check.yml, and.github/workflows/dependabot-auto-merge.ymlas part of the org-wide Dependabot rollout.