chore(repo): SECURITY.md, Dependabot config, CodeQL workflow#3
Merged
Conversation
Brings the repo up to professional-OSS baseline alongside the GitHub-side settings (squash-only merges, delete-on-merge, Discussions enabled, secret scanning + push protection on, Dependabot alerts + security updates on). - SECURITY.md Documents the supported version line (0.5.x), the private reporting channels (GitHub PVR draft advisory first, email fallback), the expected response timeline (72h ack, 7d triage, 30d fix for high/crit), and the scope of what counts as in-scope (npm package, auto-update path, credential handling, hooks) vs. out-of-scope (hosted service, scanner- only reports). Also disables the implicit "just open an issue" path. - .github/dependabot.yml Weekly npm + GitHub Actions updates, Monday 07:00 Europe/Istanbul (same morning as the CodeQL scheduled scan). Grouped by logical cluster (typescript-toolchain, linters, testing, types, actions) so one weekly PR per cluster instead of N PRs per package — keeps maintenance cost proportional to the project's "no runtime deps" stance. - .github/workflows/codeql.yml JS/TS analysis with security-extended + security-and-quality query packs. Runs on PR + push to main + weekly schedule. Permissions scoped to the minimum CodeQL needs to upload SARIF. Branch protection on main is configured separately via the GitHub API and will require this workflow's check before merge once the first run completes.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the repository up to a professional-OSS baseline alongside the GitHub-side settings already applied via the API.
What's in this PR
SECURITY.md— Documents supported version line, private reporting channels (GitHub Private Vulnerability Reporting first, email fallback), expected response SLA (72h ack / 7d triage / 30d fix for high/crit), and explicit in-scope vs. out-of-scope coverage. Discourages public issue filing for vulnerabilities..github/dependabot.yml— Weekly npm + GitHub Actions updates, grouped by logical cluster (typescript-toolchain,linters-and-formatters,testing,types,actions). One PR per group per week instead of one per package — proportional to a "no runtime deps" project..github/workflows/codeql.yml— JS/TS static analysis withsecurity-extended+security-and-qualityquery packs. Runs on PR, on push to main, and on a weekly schedule (Mondays 06:00 UTC, same morning as Dependabot).Already applied via the GitHub API (no diff)
ISSUE_TEMPLATE/config.yml)Follow-up
Branch protection on
mainwill require this PR's CodeQL workflow once the first run completes — set as a separate API call once the workflow registers a status context. Documented in the PR comment thread.Test plan
Test (Node 20)passesTest (Node 22)passesRelated
contextify update#1 — preceding feature PR + 6 rounds of code reviewv0.5.0— npm release backing this repo's professional-OSS rollout