Repository navigation
ci: review dependency vulnerabilities on pull requests - #32
Merged
Merged
Conversation
zoeyrose
marked this pull request as ready for review
October 11, 2026 16:33
Member
Author
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Member
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
🎉 This PR is included in version 2.10.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
zoeyrose
added a commit
to atrinik/github-settings
that referenced
this pull request
Oct 12, 2026
## Summary Close active-repository security governance gaps while keeping required human approvals at zero and normal Dependabot updates working. Archived `nawerhals` is excluded. The policy stays compatible with GitHub Team and existing public-repository security entitlements. ## Implementation / behavior - Restore service-updater's existing pull-request, aggregate CI and release-tag protections through the governed inventory. - Add read-only Dependency review workflows here and in the component PRs below. Newly introduced high/critical vulnerabilities in runtime, development and unknown scopes fail; moderate/low findings and license scores do not block. PR retargeting and merge groups are covered without checkout or contributor-code execution. - Record per-gate pending/enforced source intent for repository-owned Dependency review and CodeQL high/critical gates. Pending only probes landed successful producer evidence; reviewed promotion precedes first installation. Enforced intent makes absence drift and permits restoration after deletion or later producer failure. Preserve aggregate checks, zero approvals and owner pull-request-only bypass. Existing gates must be effective on the default branch with the intended tool/context before initial-readiness grandfathering applies. - Use ordinary required CI with repository writers explicitly trusted. The Actions app/context does not attest immutable workflow bytes; a writer can modify the producer in the same PR. The high/critical gate remains for ordinary dependency changes, with zero required human approvals. This security finding is an explicitly accepted policy limitation, not a claim of tamper resistance. - Require Rust coverage in content-toolkit while preserving its other configured languages. Require Classic’s five semantic scope/language partitions independently of the producer’s current declarations; every declared additional partition also needs its own successful job and matching analysis. Producer or run subsets cannot qualify. Readiness structurally binds executable classifier outputs, dynamic matrix, scoped generated configuration, official full-SHA CodeQL actions and the unconditional aggregate. Qualification also requires ordinary PR activities targeting the live default branch without path filters. Trusted producer helpers retain path semantics; no action-version or source-path catalog is added. - Allow publishing action families with `@*` while retaining full SHAs in workflows. Persist SHA rollout as `pending`; promotion requires reviewed source state and a proven ordinary action-update PR. Canaries require active selected-actions policy, an enabled repository, and configured plus effective status contexts including Dependency review. Legacy requirements come from full protection state; ambiguous absence responses fail closed, while an exact disabled response requires the identity-bound read-only GraphQL null proof. Stored merged canaries remain verifiable after GitHub clears association arrays; open canaries require current-base proof. Reusable-workflow updates cannot qualify as action-pin canaries. Unchanged reusable references and normal action subpaths remain supported. No parallel version catalog or exact-SHA allowlist assertions are introduced. - Stage conservative Actions mode, then selected patterns, then revalidated proof before restoring SHA enforcement; re-read live SHA state after staging. Converge repository workflow-permission overrides and retire only exact owned security gates removed from inventory. Repository-scope aggregate CI retirement requires exact reviewed prior repository/ruleset identities and contexts; missing provenance retains the rule. Existing security-gate PUTs re-read and validate the rule immediately before updating, retaining concurrent modifications. Pending existing-gate proof also binds its checked default branch to final repository metadata, preventing a branch change from activating unqualified protection. The final detail must also retain the proven enforcement and ref applicability; concurrent disabling or retargeting invalidates pending proof while enforced restoration remains supported. Security-gate retirement re-reads the exact rule after the repository metadata fence immediately before DELETE and stops on unreadable evidence. Complete validated paginated ruleset inventories precede identity, absence, update and retirement decisions in both scopes; failed or malformed pages and duplicate IDs/names stop publication. Preserve archived repositories, foreign rules, modified same-name policy and existing security attachments. - Audit complete effective default and declared maintenance branch rule types and parameters, rejecting undeclared integrity or restriction rules while preserving the intended combined CI/security checks. Audit repository/inherited policy, complete organization scopes, security-gate ownership, scanning coverage, readable configured language arrays, security features, permissions and rollout state. Reject stale, contradictory or ambiguous producer evidence; a newer queued/failing check cannot hide behind an older success. Audit also reads full legacy protection on every active default and declared maintenance branch; any presence is manual drift under the canonical ruleset contract, and unreadable responses fail closed. The exact repository-disabled REST response uses a fixed read-only GraphQL query to prove a matching active repository and exact branch with an explicitly null legacy association; historical rules on other refs remain untouched. Retained named security gates on non-target repositories are drift even when disabled, modified or scoped to another branch. ### Component workflow PRs | Repository | Dependency | | --- | --- | | agent-integrations | [#2](atrinik/agent-integrations#2) | | atrinik | [#648](atrinik/atrinik#648) | | classic | [#591](atrinik/classic#591) | | client | [#67](atrinik/client#67) | | content | [#267](atrinik/content#267) | | content-toolkit | [#32](atrinik/content-toolkit#32) | | deploy-control | [#11](atrinik/deploy-control#11) | | devcontainer | [#57](atrinik/devcontainer#57) | | editor | [#33](atrinik/editor#33) | | metaserver-worker | [#178](atrinik/metaserver-worker#178) | | observatory | [#51](atrinik/observatory#51) | | playtester | [#31](atrinik/playtester#31) | | protocol | [#50](atrinik/protocol#50) | | renderer | [#38](atrinik/renderer#38) | | resources | [#22](atrinik/resources#22) | | server | [#99](atrinik/server#99) | | service-updater | [#13](atrinik/service-updater#13) | | sound | [#38](atrinik/sound#38) | | tools | [#29](atrinik/tools#29) | | website | [#70](atrinik/website#70) | ## Validation - Independent security review approved the integrated policy, subsequent exact repairs and normal integration of the latest merged governance base, including the protected development-environment inventory and value-free credential metadata. All 173 readiness tests pass, including current/historical base binding, merged association fallback, queued checks, contradictory references and freshness failures. Default and advanced CodeQL readiness reselect newest analysis coverage before returning; failure, deletion, zero-rule scans and changing successful records cannot qualify. - All 26 integrated policy shell suites pass on the final review repairs, including concurrent retirement changes and disabled, retargeted or modified non-target rules. Independent audit, publisher and schema suites pass. Exact optional GitHub API defaults normalize in audit and publisher without hiding nondefault, malformed, unknown-field or real scope drift. Pending gates never install; enforced missing gates remain drift even with failing producers. Restoration fences repository ID, full name and archive state, retaining foreign and unexpectedly modified rules. Portable shell assertions also pass with ripgrep absent; credential-leak assertions remain active. - JSON validation, ShellCheck, actionlint and whitespace checks pass. Fresh required CI and Codex code/security reviews must pass at the published final head before merge. - The actual pinned official dependency-review action passed clean, moderate, high, critical, unknown-scope, unreadable API and merge-group fixtures. License metadata does not introduce an extra blocking gate. A fresh independently reviewed Node 24 reproduction confirms the pinned production bundle natively infers merge-group SHA refs without explicit inputs; vulnerability/API/malformed-event failures remain enforced. - Read-only live planning preserves existing security attachments, accepts landed merged producers and defers missing or unhealthy producer proof. A live Atrinik dependency preflight confirms the merged-PR association fallback. Fresh read-only audit results distinguish unapplied desired-state drift from pending rollout; no successful live activation is claimed. ## Limitations / follow-up This changes desired source only; no live settings apply or workflow dispatch is included. Merge available component workflows and this reviewed policy, then inspect a fresh plan from merged source before separately authorized activation. Content #267 and resources #22 are explicitly held until compatible upstream release-tool vulnerability fixes exist. No advisory exceptions or weakened thresholds are added. Devcontainer #57 is merged after required CI and both Codex reviews passed. Its unchanged-input branch-push benchmark remains separate and is not claimed passed. The held content/resources dependency gates remain deferred until their producers land and pass. Content-toolkit needs its first successful Rust scan after configuration rollout. Classic's latest read-only readiness probe now qualifies; its gate remains pending until reviewed source promotion and fresh live proof. Every activation rechecks live proof rather than relying on this description. Existing CodeQL default setup exempts Dependabot PRs from its scan merge requirement; dependency review remains independent. Merge-queue limitations and alert semantics are documented in README. SHA enforcement remains pending. Promote the phase and accepted canary through normal source review only after the actual allowlist and an ordinary action-update PR prove compatibility. Pending command-line canaries only probe readiness. The APIs establish current conservative policy and PR-run proof, not a historical policy-settings attestation. Enforced drift is reported and restored only with revalidated proof. Rollback preserves enforced gate intent on later PR failures. Initial gate intent remains pending until reviewed producer qualification and source promotion; no new gate installs in this change. An intentional rollback removes targets and their activation entries through reviewed inventory changes and separately authorized publication, deleting only exact repository-owned managed rulesets. Existing repository-level aggregate CI also requires a retained explicit prior-rule retirement record. Existing security baseline attachments and aggregate CI remain required.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a dependency review check for pull requests targeting
main. Newly introduced high or critical vulnerable dependencies fail the check.Implementation / behavior
The dedicated
Dependency reviewjob uses the official action with read-only repository permissions and reviews runtime, development, and unknown dependency scopes. It runs for every pull request, including Dependabot and fork contributions, without checking out or executing PR code. Lower-severity findings do not block the check.The workflow uses a full action commit SHA that Dependabot can update normally; it adds no separate approved-version list, license gate, or human-approval requirement.
Validation
Limitations / follow-up
Repository aggregate validation and live fork/Dependabot acceptance remain pending CI. Required-check enforcement will be published separately after this workflow lands and passes.
Automated review follow-up
Dependency review now handles PR retargeting and merge queue groups. The official action uses the appropriate event revisions without checking out or executing contributor code. Fresh CI and Codex code/security reviews are required at this updated head.