Repository navigation
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces Security Gate v2 as a reusable GitHub Actions entry point for running the repository’s baseline security scans, while updating the surrounding docs and release metadata to support external consumer onboarding. It shifts the project from a locally orchestrated set of workflows toward a productized shared workflow model with versioned examples and documentation.
Changes:
- Add a new product-level reusable workflow,
.github/workflows/reusable-security-gate.yml, and switch the local baseline workflow to delegate to it. - Update dashboard aggregation to fetch scripts/assets from a configurable repository and ref, enabling consumers to reuse the dashboard without copying local assets.
- Add v2 release/onboarding materials, including README updates, architecture/preset/onboarding/release docs, examples, changelog, and versioning files.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/reusable-security-gate.yml |
Adds the new reusable entry-point workflow, mode validation, and orchestration of the existing scan workflows. |
.github/workflows/reusable-dashboard.yml |
Updates dashboard generation to checkout scripts/assets from a configurable repo/ref before aggregating artifacts. |
.github/workflows/security-baseline.yml |
Replaces the prior multi-job local orchestration with a single call into the new reusable gate. |
README.md |
Rebrands the project as Security Gate v2 and documents quick start, presets, advanced usage, and stable release guidance. |
SECURITY.md |
Updates supported scope language to reflect the v2 reusable gate and dashboard artifacts. |
CHANGELOG.md |
Adds the initial v2.0.0 release notes. |
VERSION |
Records the new release version as 2.0.0. |
docs/architecture.md |
Describes the v2 product workflow, presets, and updated artifact flow. |
docs/onboarding.md |
Adds consumer onboarding guidance, default workflow example, and input reference. |
docs/presets.md |
Documents audit, strict, and custom-policy preset usage. |
docs/release-management.md |
Adds release-tagging, pinning, and release checklist guidance for consumers and maintainers. |
docs/secure-coding-standard.md |
Updates the secure coding standard heading to v2. |
examples/security-gate-audit.yml |
Adds a copy-paste consumer example for audit mode. |
examples/security-gate-strict.yml |
Adds a copy-paste consumer example for strict mode. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+40
to
+45
| - name: Checkout Security Gate assets | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: ${{ inputs.gate_repository }} | ||
| ref: ${{ inputs.gate_ref }} | ||
| path: security-gate |
Comment on lines
+42
to
+44
| description: Git ref for Security Gate scripts and dashboard assets. | ||
| required: false | ||
| default: v2 |
| deploy_pages: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | ||
| mode: strict | ||
| semgrep_config: auto | ||
| repo_name: ${{ github.repository }} |
Comment on lines
+109
to
+113
| - secrets | ||
| - sast | ||
| - sca | ||
| - sbom | ||
| if: always() |
Comment on lines
+47
to
+50
| permissions: | ||
| contents: read | ||
| pages: write | ||
| id-token: write |
Comment on lines
+21
to
+24
| gate_ref: | ||
| description: Git ref for Security Gate scripts and dashboard assets | ||
| required: false | ||
| default: v2 |
added 2 commits
May 2, 2026 17:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces Security Gate v2.0.0, a major rewrite that productizes the security gate as a reusable GitHub Actions workflow for approved repositories. The update replaces the previous orchestrator with a single entry-point workflow, adds audit/strict presets, improves documentation, and streamlines onboarding for consumers. The release also introduces stable asset checkout, a changelog, and new documentation for onboarding and presets.
Major feature: Security Gate v2.0.0
Security workflow architecture and features:
.github/workflows/reusable-security-gate.yml, a product-level reusable workflow that orchestrates all baseline scans (secrets, SAST, SCA, SBOM) and dashboard generation, with support for audit and strict presets via themodeinput..github/workflows/security-baseline.ymlto delegate all security scanning and dashboard generation to the newreusable-security-gate.yml, simplifying local usage and consumer onboarding..github/workflows/reusable-dashboard.ymlto support asset checkout from a configurable repository and ref (gate_repository,gate_ref), decoupling dashboard scripts from consumer repositories. [1] [2] [3]Documentation and onboarding:
README.md(project overview, quick start, presets, advanced usage),docs/architecture.md(architecture and artifact flow),docs/onboarding.md(onboarding guide), anddocs/presets.md(preset usage and customization). [1] [2] [3] [4] [5] [6] [7]CHANGELOG.mddocumenting the initial v2.0.0 release andVERSIONfile for release management. [1] [2]Security scope and release management:
SECURITY.mdto clarify supported scope for v2, including static dashboard artifacts and approved repository usage.gate_refto the same release tag.This release makes it much easier for approved repositories to adopt a secure, consistent, and upgradable DevSecOps baseline with minimal setup.