ci: review the dependencies a pull request adds - #81
Merged
Conversation
The weekly audit reports this repository as having no dependency-review workflow, and it is right: every other repository under audit has one, and this is the only one handling checkout and payment. CodeQL reads the code written here. Nothing read the code taken on trust — NuGet packages, npm packages, and the Actions the workflows consume — so a pull request could add a known-vulnerable dependency and meet no objection until Dependabot raised it after the merge. Pull requests only: the action diffs a base against a head and has nothing to compare on a push. fail-on-severity is moderate rather than high, because a moderate finding in a checkout path is not a rounding error. Pinned by SHA, persist-credentials off, contents: read — the shape the other workflows in this repository already use. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VrPrR9jZDHewD5dKR5dyRk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes one of the three findings the weekly audit raised against this repository once it was added to the target list (devsecops-audit#5):
Every other repository under audit has this workflow; this is the only one that handles checkout and payment and does not.
CodeQL reads the code written here. Nothing read the code taken on trust — NuGet packages, npm packages, and the Actions the workflows consume — so a pull request could add a known-vulnerable dependency and meet no objection until Dependabot raised it after the merge.
Choices
pull_requestonly — the action diffs a base against a head, so there is nothing to compare on a push.fail-on-severity: moderaterather thanhigh, because a moderate finding in a checkout path is not a rounding error.persist-credentials: false,contents: read— the shapesecret-scan.ymland the other workflows here already use, and the sameactions/checkoutpin.The other two findings are settings, not code, and remain open:
WidgetWorks push protection off— Settings → Advanced Security → Push protectionWidgetWorks private vuln reporting off— same pageGenerated by Claude Code