Repository navigation
docs: security policy rewrite + supply-chain security guide - #313
Conversation
SECURITY.md: supported versions corrected to latest-only (bestax-bulma 5.x, create-bestax 3.x — the table listed stale 2.x/1.x), new Supply-Chain Security section describing the live measures (blocked install scripts, dependency cooldown, isolated linker, frozen-lockfile CI, npm provenance, OIDC trusted publishing, SHA-pinned Actions, CodeQL, dependency review, Dependabot). Reporting flow unchanged. New docs page /docs/guides/security covering the same posture from the consumer angle (how to verify provenance, lockfile hygiene) plus the reporting channels; linked from the site footer. Closes #182 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughThe change limits security support to current release lines, documents supply-chain protections and verification steps, adds a Docusaurus Security guide, and links it from the documentation footer. ChangesSecurity Documentation
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Preview DeploymentPreview URL: https://a76d1e46.bestax.pages.dev |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Deep review — 0 finding(s)
| # | Severity | Area | Finding | Location |
|---|---|---|---|---|
| — | — | — | No blocking defects found. | — |
Overall: This is a docs-only change (SECURITY.md, a new /docs/guides/security page, and a footer link), and every factual claim in it verifies against the actual repo: supported majors match the published versions (bestax-bulma 5.6.1, create-bestax 3.3.1); the supply-chain bullets map 1:1 to real config — allowBuilds, minimumReleaseAge: 4320 (= 3 days), nodeLinker: isolated, --frozen-lockfile with the React-matrix --no-frozen-lockfile exception, publishConfig.provenance: true in both packages, OIDC with no NPM_TOKEN, SHA-pinned actions, dependency-review-action at fail-on-severity: high, and weekly grouped Dependabot. The new guides page is picked up by the autogenerated guideSidebar, and the footer to: '/docs/guides/security' route is correct. The one thing a human should confirm is the CodeQL claim: there is no codeql workflow file in .github/workflows/ and the code-scanning API isn't accessible from here — if CodeQL is enabled via GitHub "default setup" the statement is accurate, otherwise that bullet (in both SECURITY.md and the guide) should be dropped.
🏄 Clean little docs set, dude — the whole thing just mirrors the real pipeline, no crumbly claims to wipe out on. Only ripple is that CodeQL line; give the code-scanning settings a quick paddle-check and this one's good to send.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/docs/guides/security.md`:
- Around line 73-75: Update the disclosure SLA wording in the security guide to
match SECURITY.md by qualifying the 7-day triage commitment with the project’s
“aims to” language, while preserving the existing acknowledgment and
disclosure-process references.
- Around line 45-47: Update the dependency-install security statement near the
allow-list description to limit the guarantee to unapproved dependency lifecycle
scripts. Clarify that packages permitted by pnpm’s allowBuilds configuration may
still run install/postinstall hooks, and avoid claiming that all dependency
install scripts are blocked.
In `@SECURITY.md`:
- Around line 23-25: Update the dependency cooldown descriptions in SECURITY.md
(lines 23-25) and docs/docs/guides/security.md (lines 48-50) to state that the
3-day minimumReleaseAge is the default behavior, while noting that the dev-only
formatter dependency prettier is excluded from this cooldown.
- Around line 47-49: Clarify in SECURITY.md (lines 47-49) and
docs/docs/guides/security.md (lines 34-39) that npm audit signatures applies
only to npm-managed installs. Keep the pnpm frozen-lockfile guidance separate
and ensure both documents consistently distinguish the npm provenance check from
pnpm workflows.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: c04d9305-2149-433c-8cbb-14585b3aa9dc
📒 Files selected for processing (3)
SECURITY.mddocs/docs/guides/security.mddocs/docusaurus.config.js
… verify, SLA wording CodeRabbit review round on #313: the allow-list caveat on the install-script claim, the prettier cooldown exclusion, npm-CLI scoping for `npm audit signatures`, and "aim to" triage wording matching SECURITY.md. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Preview DeploymentPreview URL: https://5fbe382e.bestax.pages.dev |
|
Re the deep review's one confirm-item (CodeQL): verified live before writing the claim — |
|
🎉 This PR is included in version 5.6.2 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 3.3.2 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 1.0.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
🎉 This PR is included in version 1.0.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
1 participant
Closes #182 — part 3 of 3 of the supply-chain initiative (① Actions hardening and ② the pnpm migration #180 already shipped; this documents what's live).
What
SECURITY.mdmainmeans latest is always the patched line).allowBuilds+minimumReleaseAge+ isolated linker inpnpm-workspace.yaml,--frozen-lockfileinci.yml(with the React-matrix exception called out honestly),publishConfig.provenancein both package.json files, OIDC trusted publishing (noNPM_TOKEN) in the release job, SHA-pinned actions, CodeQL default setup (js/ts + actions),dependency-review.yml, weekly grouped Dependabot.docs/docs/guides/security.md(/docs/guides/security) — the same posture from the consumer angle: what provenance/OIDC publishing means for them, how to verify (npm audit signatures, npmjs.com Provenance section, lockfile hygiene), latest-only support, and the private reporting channels.docusaurus.config.js.Notes
sidebar_position: 10(last, after Helpers).llms.txt) — no existing URLs move.Verification
pnpm allgreen, including the Docusaurus production build (which fails on broken links — the new page's internal links resolve).🤖 Generated with Claude Code
Summary by CodeRabbit