chore(security): harden repo posture - #35
Conversation
Review Summary by QodoHarden repository security posture with action pinning, Dependabot, and supply-chain controls
WalkthroughsDescription• Pin all third-party GitHub Actions to commit SHAs with version comments • Add Dependabot configuration for weekly pip and GitHub Actions updates • Add OSV-Scanner security workflow for daily malicious package detection • Enforce uv sync --frozen in CI to prevent silent lockfile changes • Add SECURITY.md documenting supply-chain controls and responsible disclosure • Add mandatory security rules to AGENTS.md for coding agents Diagramflowchart LR
A["GitHub Actions"] -->|"Pin to commit SHAs"| B["Hardened Workflows"]
C["Dependencies"] -->|"Weekly Dependabot updates"| D["Supply-chain Protection"]
E["Malicious Packages"] -->|"OSV-Scanner daily scan"| F["Security Events"]
G["Lockfile"] -->|"Enforce --frozen flag"| H["Immutable Builds"]
B --> I["Enhanced Security Posture"]
D --> I
F --> I
H --> I
File Changes1. .github/dependabot.yml
|
Code Review by Qodo
1. Frozen sync breaks CI
|
c65cc91 to
25b1ea2
Compare
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | ||
| - name: Install dependencies | ||
| run: uv sync --extra dev --extra deploy | ||
| run: uv sync --frozen --extra dev --extra deploy |
There was a problem hiding this comment.
1. Frozen sync breaks ci 🐞 Bug ☼ Reliability
python-package.yml now runs uv sync --frozen in the build job while still testing Python 3.10/3.11, but both pyproject.toml and uv.lock require Python >=3.12, so dependency install will fail on those matrix entries. This will break CI for PRs/merges until the matrix is aligned with the supported Python versions (or the lock/project constraints are changed).
Agent Prompt
## Issue description
The CI build matrix includes Python 3.10/3.11, but the project and lockfile require Python >=3.12. With the newly enforced `uv sync --frozen`, installs will fail for unsupported Python versions.
## Issue Context
- `pyproject.toml` declares `requires-python = ">=3.12"`.
- `uv.lock` also declares `requires-python = ">=3.12"`.
- The workflow build job still runs for `python-version: ["3.10", "3.11", "3.12", "3.13"]` and now uses `uv sync --frozen`.
## Fix Focus Areas
- .github/workflows/python-package.yml[40-55]
- pyproject.toml[1-6]
- uv.lock[1-9]
## Suggested fix
Update the build matrix to only include supported versions (e.g., `3.12` and `3.13`). If you truly need to test 3.10/3.11, you must also change `requires-python` and regenerate a compatible lockfile (but that contradicts the current project metadata).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c65cc91a1b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| name: Security scan | ||
|
|
||
| on: | ||
| pull_request: |
There was a problem hiding this comment.
This workflow triggers on pull_request and always runs SARIF upload, but pull requests from forks (and Dependabot PRs) receive a read-only GITHUB_TOKEN, so write operations like code-scanning uploads can fail with Resource not accessible by integration. Because upload-sarif requires security-events: write, this can cause otherwise-valid PR checks to fail for external contributors; restrict the upload step to trusted contexts (for example push/schedule or non-fork PRs).
Useful? React with 👍 / 👎.
2 participants
Summary
trufflehog@main(critical: floating branch),softprops/action-gh-release@v3,astral-sh/setup-uv@v7,pypa/gh-action-pypi-publish@release/v1; all now pinned to commit SHAs with version commentspypienvironment required reviewer — alain-sv must approve before OIDC publish secrets are exposed; previously any push tomaintriggered an immediate PyPI release with no gate.github/dependabot.yml— weekly updates for pip + github-actions ecosystems with a 5-day cooldown window (supply-chain worm mitigation)security-scan.yml— OSV-Scanner (Google, free) runs daily and on every PR against the OSV.dev malicious package index; SARIF uploaded to GitHub Security tabuv sync --frozenin CI — lockfile cannot silently change during buildsSECURITY.md— responsible disclosure via GitHub private advisories; documents supply-chain postureAGENTS.md— mandatory rules for coding agents (no direct pushes to main, no lockfile hand-edits, no workflow modifications without approval, nohatch publishlocally)GitHub settings applied (outside this diff)
v*tags are now immutableTest plan
Python packageworkflow)maintriggers pypi environment approval request before publish step🤖 Generated with Claude Code