Repository navigation
security: harden GitHub automation and repository controls - #42
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Harden public repository automation with verified upstream commit SHA pins, current CodeQL/artifact actions, read-only checkout credentials, explicit job timeouts, and dependency review that blocks newly introduced known vulnerabilities. Add ownership for security-sensitive files and document the repository controls and release recovery requirements.
Repository settings now enable Dependabot alerts/security fixes, approval for every external fork contributor, private vulnerability reporting, immutable future releases, all eight CI/security checks as required checks, and a CodeQL findings rule with an explicit administrator bypass. CodeQL uses the extended security queries. Administrator bypass remains enabled (
enforce_admins: false) so the owner can merge their own pull requests.Validation: actionlint v1.7.12,
git diff --check, and all nine PR checks passed for the integrated head. CI, extended CodeQL, and Release passed again on main commit67b3b2e63610318247c3e2769eb5a211bc5caecd. Releasev1.4.1was published withimmutable: true. Administrator bypass was exercised during integration and confirmed afterward in both branch protection and the CodeQL ruleset. Final Dependabot, code scanning, and secret scanning open alert counts are all zero.