From 68e147fc90a817d0d7d704fcac8f63e3dd3e14b8 Mon Sep 17 00:00:00 2001 From: DJ Date: Fri, 27 Mar 2026 13:44:40 -0700 Subject: [PATCH 1/3] fix: address OpenSSF Scorecard findings - Add SECURITY.md (#18) - Scope workflow token permissions to read-all with per-job overrides (#19) - Pin all GitHub Action dependencies to commit SHAs (#20) - Ensure SAST (CodeQL) runs on all push commits to main (#21) Closes #18, #19, #20, #21 Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude.yml | 2 ++ .github/workflows/codeql-analysis.yml | 8 ++++-- .github/workflows/dependabot-automerge.yml | 11 ++++---- .github/workflows/sonarcloud.yml | 10 +++++-- SECURITY.md | 33 ++++++++++++++++++++++ 5 files changed, 53 insertions(+), 11 deletions(-) create mode 100644 SECURITY.md diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 7297276c..efffe09a 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -9,6 +9,8 @@ on: pull_request_review_comment: types: [created] +permissions: read-all + jobs: claude: if: >- diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 71b2c59f..d233ea85 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -10,6 +10,8 @@ on: schedule: - cron: '0 6 * * 1' +permissions: read-all + jobs: analyze: name: Analyze (Python) @@ -19,14 +21,14 @@ jobs: security-events: write steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3 with: languages: python - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3 with: category: '/language:python' diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 6c5625f0..bf87a594 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -5,25 +5,26 @@ on: branches: - main -permissions: - contents: write - pull-requests: write +permissions: read-all jobs: dependabot: runs-on: ubuntu-latest if: github.event.pull_request.user.login == 'dependabot[bot]' + permissions: + contents: write + pull-requests: write steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v2 + uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v2 with: github-token: '${{ secrets.GITHUB_TOKEN }}' - name: Generate app token if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-type == 'indirect' id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3 with: app-id: ${{ secrets.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 368894ce..91416a51 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -1,16 +1,20 @@ name: SonarCloud Analysis -permissions: - contents: read - pull-requests: read + on: push: branches: [main] pull_request: branches: [main] + +permissions: read-all + jobs: sonarcloud: name: SonarCloud runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} steps: diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..b3d3ec15 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,33 @@ +# Security Policy + +## Supported Versions + +| Version | Supported | +| ------- | ------------------ | +| latest | :white_check_mark: | + +## Reporting a Vulnerability + +If you discover a security vulnerability in this project, please report it responsibly. + +**Please do NOT open a public GitHub issue for security vulnerabilities.** + +Instead, please send an email to the repository maintainers or use [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-creating-advisories/privately-reporting-a-security-vulnerability) feature on this repository. + +When reporting a vulnerability, please include: + +- A description of the vulnerability +- Steps to reproduce the issue +- Potential impact of the vulnerability +- Suggested fix (if any) + +## Response Timeline + +- We will acknowledge receipt of your report within **48 hours**. +- We will provide an initial assessment within **5 business days**. +- We aim to release a fix within **30 days** of confirming the vulnerability. + +## Security Best Practices + +- Keep your dependencies up to date. +- Review the project's dependency tree for known vulnerabilities using `pip audit` or similar tools. From 73a4c22284e5ae7036249094b9fb9399002195ee Mon Sep 17 00:00:00 2001 From: DJ Date: Fri, 27 Mar 2026 19:27:30 -0700 Subject: [PATCH 2/3] fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Add concrete security contact email to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude.yml | 2 +- .github/workflows/codeql-analysis.yml | 2 +- .github/workflows/dependabot-automerge.yml | 2 +- .github/workflows/sonarcloud.yml | 2 +- SECURITY.md | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index efffe09a..6b415b77 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -9,7 +9,7 @@ on: pull_request_review_comment: types: [created] -permissions: read-all +permissions: {} jobs: claude: diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index d233ea85..c45404e6 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -10,7 +10,7 @@ on: schedule: - cron: '0 6 * * 1' -permissions: read-all +permissions: {} jobs: analyze: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index bf87a594..1289fbf0 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -5,7 +5,7 @@ on: branches: - main -permissions: read-all +permissions: {} jobs: dependabot: diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 91416a51..f7501b09 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -6,7 +6,7 @@ on: pull_request: branches: [main] -permissions: read-all +permissions: {} jobs: sonarcloud: diff --git a/SECURITY.md b/SECURITY.md index b3d3ec15..589cf4bd 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,7 +12,7 @@ If you discover a security vulnerability in this project, please report it respo **Please do NOT open a public GitHub issue for security vulnerabilities.** -Instead, please send an email to the repository maintainers or use [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-creating-advisories/privately-reporting-a-security-vulnerability) feature on this repository. +Instead, please send an email to [security@petry-projects.dev](mailto:security@petry-projects.dev) or use [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-creating-advisories/privately-reporting-a-security-vulnerability) feature on this repository. When reporting a vulnerability, please include: From ccb56fa38653f9923847c87da73d7c8696fe5a0c Mon Sep 17 00:00:00 2001 From: DJ Date: Sat, 28 Mar 2026 06:17:44 -0700 Subject: [PATCH 3/3] fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --- .github/workflows/claude.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 6b415b77..9c0c27e4 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -33,4 +33,4 @@ jobs: - name: Run Claude Code uses: anthropics/claude-code-action@094bd24d575e7b30ac1576024817bf1a97c81262 # v1 with: - anthropic_api_key: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}