chore(security): standardize SDLC security baseline - #155
Open
ashu-tosh-kumar wants to merge 1 commit into
Open
Conversation
Align repo with the standardized security baseline across all public projects: - Add Dependency Review (PR gate blocking known-vulnerable deps). - Add OpenSSF Scorecard (supply-chain posture, reports to Security tab). - Add Bandit Python SAST (Python repos only; replaces OSSAR coverage). - Dependabot: add github-actions ecosystem + grouped updates. - Remove redundant/dead workflows (OSSAR, disabled advanced CodeQL, gitleaks/npm-audit) now covered by CodeQL default setup, native secret scanning + push protection, and Dependabot. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Dependabot configuration to group updates and adds tracking for GitHub Actions. The reviewer correctly identified that the Python package ecosystem should be configured as "poetry" instead of "pip" to ensure that Poetry lockfiles are updated properly.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Comment on lines
+2
to
+7
| # - pip ecosystem covers Poetry (pyproject.toml / poetry.lock). | ||
| # - github-actions keeps workflow action versions current (supply-chain hardening). | ||
| # Updates are grouped to minimize PR noise. | ||
| version: 2 | ||
| updates: | ||
| - package-ecosystem: "pip" # See documentation for possible values | ||
| directory: "/" # Location of package manifests | ||
| - package-ecosystem: "pip" |
There was a problem hiding this comment.
Since this project uses Poetry for dependency management (as defined in pyproject.toml), the package-ecosystem should be set to poetry instead of pip. Dependabot has native support for poetry which correctly updates both pyproject.toml and poetry.lock. Using pip will not update the Poetry lockfile properly and may fail.
# - poetry ecosystem covers Poetry (pyproject.toml / poetry.lock).
# - github-actions keeps workflow action versions current (supply-chain hardening).
# Updates are grouped to minimize PR noise.
version: 2
updates:
- package-ecosystem: "poetry"
CI Feedback 🧐A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| persist-credentials: false | ||
|
|
||
| - name: "Run analysis" | ||
| uses: ossf/scorecard-action@v2.4.0 |
| branches: ["development"] | ||
|
|
||
| # Declare default permissions as read only. | ||
| permissions: read-all |
PR Summary by QodoStandardize repo SDLC security baseline (Dependabot, Bandit, Scorecard, Dependency Review)
AI Description
Diagram
High-Level Assessment
Files changed (4)
|
Code Review by Qodo
1. Security checks skip main
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+5
to
+8
| on: | ||
| pull_request: | ||
| branches: ["development"] | ||
|
|
There was a problem hiding this comment.
1. Security checks skip main 🐞 Bug ⛨ Security
.github/workflows/dependency-review.yml and .github/workflows/bandit.yml only trigger for PRs targeting development, so pull requests into main won’t run dependency-vulnerability gating or publish Bandit SARIF results. This creates a security coverage gap because other workflows in this repo clearly operate on main, indicating it is an active integration/release branch.
Agent Prompt
### Issue description
Dependency Review and Bandit workflows are configured to run only when the PR target branch is `development`, which leaves `main` PRs without these security checks.
### Issue Context
This repo already runs CI and docs builds on `main`, so `main` appears to be an active branch that should receive the same security baseline coverage.
### Fix Focus Areas
- .github/workflows/dependency-review.yml[5-8]
- .github/workflows/bandit.yml[7-13]
### Suggested change
Update workflow triggers to include both branches, e.g.:
```yaml
on:
pull_request:
branches: ["main", "development"]
```
(and similarly for `push` in `bandit.yml`).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Standardizes this repo against the security baseline shared across all public projects.
Added
github-actionsecosystem + grouped weekly updates.Removed
.github/workflows/ossar.yml.github/workflows/codeql.ymlThese were redundant with CodeQL default setup (live), native secret scanning + push protection, and Dependabot — all enabled at the repo level.
Coverage after this PR
🤖 Generated with Claude Code