ci: drop GitHub Advanced Security dependent CI (CodeQL, dependency-review, SARIF ingestion) #109
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -211,7 +211,6 @@ on: | |
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| env: | ||
| INFISICAL_DOMAIN: https://secrets.byronwilliamscpa.com | ||
|
|
@@ -288,34 +287,42 @@ jobs: | |
| INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }} | ||
| ``` | ||
|
|
||
| ### 3.3 Dependency Vetting (PRs) | ||
|
|
||
| `actions/dependency-review-action` relies on GitHub's dependency-graph diff | ||
| and GitHub Advanced Security (Code Security), a paid GitHub feature; without | ||
| it the action either fails to resolve a diff or (with `continue-on-error`) | ||
| silently reports nothing. Do not add `dependency-review.yml` unless GHAS is | ||
| actually enabled and verified on the target repo. | ||
|
Comment on lines
+292
to
+296
Comment on lines
+292
to
+296
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🔎 Supported by static analysis🌐 Web query:
💡 Result: According to official GitHub documentation, the dependency-review-action is available for all public repositories without requiring GitHub Advanced Security (GHAS) or GitHub Code Security [1][2][3]. For private and internal repositories, the action requires either a GitHub Code Security or a GitHub Advanced Security license [1][2][3]. The action is designed to scan pull requests for dependency changes and enforce security or license policies, and it is explicitly available for public repositories by default [4][5][1]. Citations:
🏁 Script executed: printf '%s\n' '--- repository conventions ---'
head -5 /tmp/coderabbit-repo-knowledge/byronwilliamscpa-cookiecutter-python-template-0256906e/*/*.md 2>/dev/null || true
printf '%s\n' '--- candidate files ---'
git ls-files docs/secure.md tests/test_supply_chain_security.py
printf '%s\n' '--- docs/secure.md ---'
sed -n '270,310p' docs/secure.md
printf '%s\n' '--- relevant test sections ---'
sed -n '1,120p' tests/test_supply_chain_security.py
sed -n '390,450p' tests/test_supply_chain_security.py
printf '%s\n' '--- dependency-review references ---'
rg -n -C 3 'dependency-review|supply_chain|supply chain' --glob '!*.lock' .Repository: ByronWilliamsCPA/cookiecutter-python-template Length of output: 50403 🏁 Script executed: printf '%s\n' '--- workflow convention ---'
cat /tmp/coderabbit-repo-knowledge/byronwilliamscpa-cookiecutter-python-template-0256906e/conventions/github-workflows.md
printf '%s\n' '--- template workflow files ---'
git ls-files | rg '(^|/)dependency-review\.yml$|cookiecutter\.json|post_gen_project\.py'
printf '%s\n' '--- cleanup implementation ---'
sed -n '330,370p' hooks/post_gen_project.py
printf '%s\n' '--- cookiecutter options ---'
sed -n '1,115p' cookiecutter.json
printf '%s\n' '--- security workflow references ---'
rg -n -C 5 'dependency-review|run-dependency-review|security-analysis' '{{cookiecutter.project_slug}}' .github docs README.md CHANGELOG.mdRepository: ByronWilliamsCPA/cookiecutter-python-template Length of output: 32954 🏁 Script executed: printf '%s\n' '--- focused diff ---'
git diff --unified=12 -- docs/secure.md tests/test_supply_chain_security.py CHANGELOG.md
printf '%s\n' '--- workflow files in template tree ---'
git ls-files | rg '(^|/)workflows/[^/]+\.(yml|yaml)$' | head -80
printf '%s\n' '--- prior dependency-review workflow, if present ---'
git show HEAD^:'{{cookiecutter.project_slug}}/.github/workflows/dependency-review.yml' 2>/dev/null || true
printf '%s\n' '--- test fixtures and generator contract ---'
rg -n -C 4 'def minimal_config|def generate_project|use_org_workflows|github_org_or_user' tests/conftest.py testsRepository: ByronWilliamsCPA/cookiecutter-python-template Length of output: 12949 Keep dependency review for public generated repositories.
📍 Affects 2 files
🤖 Prompt for AI AgentsSources: Coding guidelines, Path instructions |
||
|
|
||
| For projects without GHAS, gate PRs with OSV-Scanner against the lockfile | ||
| instead, which needs no GitHub billing feature and no API key: | ||
|
|
||
| ```yaml | ||
| # .github/workflows/dependency-review.yml | ||
| name: Dependency Vetting | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: [main] | ||
| paths: | ||
| - 'pyproject.toml' | ||
| - 'uv.lock' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| osv-scan: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: OSV-Scanner dependency scan | ||
| uses: google/osv-scanner-action/osv-scanner-action@v2.3.8 | ||
|
Comment on lines
319
to
+322
There was a problem hiding this comment. 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🌐 Web query:
💡 Result: GitHub explicitly recommends pinning third-party GitHub Actions to a full-length commit SHA as the most secure practice to ensure immutability and mitigate supply chain risks [1]. Current Requirements and Recommendations: 1. Immutability and Security: Pinning to a full 40-character commit SHA is the only way to treat an action as an immutable release [1]. Unlike tags (e.g., Citations:
🏁 Script executed: #!/bin/bash
printf '%s\n' '--- applicable repository conventions ---'
head -5 /tmp/coderabbit-repo-knowledge/byronwilliamscpa-cookiecutter-python-template-0256906e/*/*.md 2>/dev/null || true
printf '%s\n' '--- changed file context ---'
git diff -- docs/secure.md
printf '%s\n' '--- target lines ---'
sed -n '285,330p' docs/secure.mdRepository: ByronWilliamsCPA/cookiecutter-python-template Length of output: 4384 Pin both actions to full commit SHAs. If full-SHA pinning is enforced, these mutable action tags may prevent the workflow from running. Replace both 🤖 Prompt for AI AgentsSource: Path instructions |
||
| with: | ||
| scan-args: |- | ||
| --lockfile=./uv.lock | ||
| ``` | ||
|
|
||
| --- | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add a migration path for existing generated projects.
The entry lists the removed workflows and the new artifact behavior, but it does not state what existing generated projects must do. Add concise steps for applying the template update, reviewing replacement SARIF artifacts, and enabling the organization
security-analysis.ymlpath when GitHub Advanced Security is available.As per coding guidelines,
CHANGELOG.mdmust document a migration path for breaking template changes.🧰 Tools
🪛 LanguageTool
[uncategorized] ~129-~129: The official name of this software platform is spelled with a capital “H”.
Context: ...o longer function without it. Removed
.github/workflows/codeql.yml, `.github/workflo...(GITHUB)
[uncategorized] ~129-~129: The official name of this software platform is spelled with a capital “H”.
Context: ...Removed
.github/workflows/codeql.yml,.github/workflows/dependency-review.yml, `.g...(GITHUB)
[uncategorized] ~129-~129: The official name of this software platform is spelled with a capital “H”.
Context: ...ithub/workflows/dependency-review.yml
,.github/codeql-config.yml,.github/codeql/cod...(GITHUB)
[uncategorized] ~130-~130: The official name of this software platform is spelled with a capital “H”.
Context: ...ew.yml
,.github/codeql-config.yml,.github/codeql/codeql-config.yml, and.code...(GITHUB)
[uncategorized] ~131-~131: The official name of this software platform is spelled with a capital “H”.
Context: ...this template repository's own CI, plus
{{cookiecutter.project_slug}}/.github/workflows/dependency-review.ymlfrom...(GITHUB)
[uncategorized] ~133-~133: The official name of this software platform is spelled with a capital “H”.
Context: ... generated projects. Removed the direct
github/codeql-action/upload-sarifstep from...(GITHUB)
[uncategorized] ~134-~134: The official name of this software platform is spelled with a capital “H”.
Context: ...codeql-action/upload-sarif
step from{{cookiecutter.project_slug}}/.github/workflows/cifuzzy.yml` (replaced with...(GITHUB)
[uncategorized] ~136-~136: The official name of this software platform is spelled with a capital “H”.
Context: ...ep) and from the standalone branch of
{{cookiecutter.project_slug}}/.github/workflows/scorecard.yml(an artifact...(GITHUB)
[uncategorized] ~139-~139: The official name of this software platform is spelled with a capital “H”.
Context: ...flow callers that expose that toggle (
.github/workflows/scorecard.yml, `{{cookiecu...(GITHUB)
[uncategorized] ~139-~139: The official name of this software platform is spelled with a capital “H”.
Context: ...gle (
.github/workflows/scorecard.yml,{{cookiecutter.project_slug}}/.github/workflows/scorecard.yml, `{{cookiecu...(GITHUB)
[uncategorized] ~145-~145: The official name of this software platform is spelled with a capital “H”.
Context: ...ched: their defaults live in the shared
ByronWilliamsCPA/.githubreusable workflow and are being reti...(GITHUB)
🤖 Prompt for AI Agents
Source: Coding guidelines