fix: address OpenSSF Scorecard findings by don-petry · Pull Request #91 · petry-projects/google-app-scripts

don-petry · 2026-03-27T20:45:16Z

Summary

Add SECURITY.md for security policy (Scorecard: Security-Policy (0/10) #85)
Add top-level permissions: read-all to all workflow files, with job-level scoping for write access (Scorecard: Token-Permissions (0/10) #86)
Pin all GitHub Action dependencies to commit SHAs (Scorecard: Pinned-Dependencies (6/10) #87)
Update vulnerable transitive dependencies (brace-expansion, yaml) via npm audit fix (Scorecard: Vulnerabilities (8/10) #88)
Add schedule trigger and ensure push/pull_request triggers on CodeQL workflow for full SAST coverage (Scorecard: SAST (9/10) #89)
All CI/test workflows already trigger on both push and pull_request to main (Scorecard: CI-Tests (9/10) #90)

Closes #85, #86, #87, #88, #89, #90

Test plan

Verify CI passes on this PR
Verify CodeQL analysis runs successfully
Verify no workflow permission errors
Verify npm audit reports 0 vulnerabilities

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Standardized workflow permissions to explicit, least-privilege defaults and moved specific grants to job level.
- Pinned CI action references to fixed commits for reproducible runs.
- Added a scheduled security scan trigger and minor workflow input naming update for an external integration.
Security
- Added SECURITY.md with vulnerability reporting channels, required report details, and target response timelines.

- Add SECURITY.md (#85) - Scope workflow token permissions to least privilege (#86) - Pin all GitHub Action dependencies to commit SHAs (#87) - Update vulnerable dependencies via npm audit fix (#88) - Add schedule trigger to CodeQL for full SAST coverage (#89) - Ensure CI and SAST run on all pushes and PRs (#90) Closes #85, #86, #87, #88, #89, #90 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-03-27T20:45:43Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ab7a972c-35b6-4d91-bb13-ba50f146fbed

📥 Commits

Reviewing files that changed from the base of the PR and between 86817ca and 586bcbd.

📒 Files selected for processing (1)

.github/workflows/claude.yml

📝 Walkthrough

Walkthrough

Top-level GitHub Actions workflows now declare empty workflow-level permissions (permissions: {}) with job-level permission blocks added/adjusted as needed. Multiple action usages were pinned from floating tags to specific commit SHAs. A new SECURITY.md was added describing vulnerability reporting channels and response timelines.

Changes

Cohort / File(s)	Summary
Workflows — CI & Tests `/.github/workflows/ci.yml`, `/.github/workflows/nodejs-tests.yml`, `/.github/workflows/playwright-tests.yml`, `/.github/workflows/coverage.yml`	Added top-level `permissions: {}` and added/adjusted job-level permissions (e.g., `contents: read`, `actions: write`). Pinned `actions/checkout`, `actions/setup-node`, and `actions/cache` from major tags to commit SHAs; preserved job steps and commands.
Workflows — Analysis & Scanning `/.github/workflows/codeql-analysis.yml`, `/.github/workflows/sonarcloud.yml`	Added top-level `permissions: {}` and explicit job-level permission blocks. Pinned `actions/checkout` and CodeQL-related action refs to commit SHAs. `codeql-analysis` also gained a `schedule` trigger (`cron: '25 14 * * 1'`).
Workflows — Dependabot & CLA / Claude `/.github/workflows/dependabot-automerge.yml`, `/.github/workflows/claude.yml`	Converted global workflow permissions to empty and moved/granted granular permissions at job level. Pinned third‑party actions to commit SHAs. In `claude.yml`, renamed action input `anthropic_api_key` → `claude_code_oauth_token` (same secret).
Security Policy `SECURITY.md`	Added a new security policy detailing supported versions, private vulnerability reporting channels (Security tab and email), required report contents, and response timelines (48h ack, 5 business-day assessment, ~30-day resolution target).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Add Claude Code GitHub Action #81 — Renames the Claude Code action input from anthropic_api_key to claude_code_oauth_token, matching the change in this PR.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The PR addresses the primary requirement from issue `#85` (add SECURITY.md for security policy), but the linked_issues section only shows `#85`, while the PR objectives reference `#85-`#90 and test plan items not explicitly linked.	Verify that all referenced issues (`#85-`#90) are properly linked in the PR. The raw_summary shows changes addressing security policy, permissions, action pinning, and npm vulnerabilities, but only `#85` appears in linked_issues.
Out of Scope Changes check	❓ Inconclusive	Changes appear partially out of scope: the PR title and objectives reference npm dependency updates (brace-expansion, yaml via npm audit fix), but the raw_summary shows no changes to package.json or package-lock.json files.	Clarify whether npm dependency updates were completed. The PR objectives list 'Update vulnerable transitive npm dependencies' but the file summaries show no package file changes.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: address OpenSSF Scorecard findings' directly relates to the main objective of the PR, which addresses multiple OpenSSF Scorecard findings (`#85-`#90) including security policy, permissions, action pinning, and npm dependencies.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch scorecard-fixes

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

This PR hardens the repository to address OpenSSF Scorecard findings by adding a security policy, tightening GitHub Actions token permissions, pinning GitHub Actions to commit SHAs, updating vulnerable transitive npm deps, and expanding CodeQL coverage.

Changes:

Add SECURITY.md security policy and reporting process.
Update GitHub Actions workflows to use top-level permissions: read-all, scope job permissions, and pin uses: actions to commit SHAs.
Run npm audit fix to update vulnerable transitive dependencies (brace-expansion, yaml) in package-lock.json, and add a scheduled CodeQL run.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
package-lock.json	Updates transitive dependencies to remediate reported vulnerabilities.
SECURITY.md	Adds a security policy and private vulnerability reporting instructions.
.github/workflows/sonarcloud.yml	Adds top-level read-only permissions and pins actions to SHAs.
.github/workflows/playwright-tests.yml	Adds top-level read-only permissions and pins actions to SHAs (but job permissions are too restrictive for cache/artifacts).
.github/workflows/nodejs-tests.yml	Adds top-level read-only permissions and pins actions to SHAs (but job permissions are too restrictive for cache).
.github/workflows/dependabot-automerge.yml	Moves to top-level read-only permissions and scopes write permissions to the dependabot job; pins actions.
.github/workflows/coverage.yml	Adds top-level read-only permissions and pins actions to SHAs.
.github/workflows/codeql-analysis.yml	Adds schedule trigger, top-level permissions, job-scoped write for `security-events`, and pins CodeQL actions.
.github/workflows/claude.yml	Adds top-level permissions and retains job-scoped permissions needed for PR/issue interactions; pins action.
.github/workflows/ci.yml	Adds top-level read-only permissions, scopes write to the autofix job, and pins actions to SHAs.

coderabbitai

🧹 Nitpick comments (2)

SECURITY.md (1)
5-8: Consider replacing latest with concrete support targets.

Using explicit branches/semver ranges (for example, main or >=x.y.z) makes the policy easier for reporters to interpret.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@SECURITY.md` around lines 5 - 8, The policy table currently lists "latest" as
the supported Version; replace that ambiguous token with explicit support
targets (e.g., a branch name like "main" or a semver range such as ">=1.2.0") so
reporters know exactly what is supported; update the table row that contains
"latest" under the Version column to a concrete branch or semver expression and
adjust the Supported column if needed to reflect the exact coverage.
.github/workflows/coverage.yml (1)
3-3: Use permissions: {} for deny-by-default workflow token baseline.

permissions: read-all at workflow scope is redundant—every job already defines explicit job-level permissions that override it. Tightening the default to permissions: {} is safer for future jobs and prevents accidental permission leakage if a new job without explicit permissions is added.
Suggested change
-permissions: read-all
+permissions: {}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/coverage.yml at line 3, The workflow-level permission
setting "permissions: read-all" is too permissive; change the workflow's
top-level permissions to an explicit deny-by-default by replacing "permissions:
read-all" with "permissions: {}" so job-level permissions remain authoritative
and prevent accidental token privilege leakage.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/coverage.yml:
- Line 3: The workflow-level permission setting "permissions: read-all" is too
permissive; change the workflow's top-level permissions to an explicit
deny-by-default by replacing "permissions: read-all" with "permissions: {}" so
job-level permissions remain authoritative and prevent accidental token
privilege leakage.

In `@SECURITY.md`:
- Around line 5-8: The policy table currently lists "latest" as the supported
Version; replace that ambiguous token with explicit support targets (e.g., a
branch name like "main" or a semver range such as ">=1.2.0") so reporters know
exactly what is supported; update the table row that contains "latest" under the
Version column to a concrete branch or semver expression and adjust the
Supported column if needed to reflect the exact coverage.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 42c031e1-cefe-4ee5-806c-3dd5a982a534

📥 Commits

Reviewing files that changed from the base of the PR and between 0fc3e49 and 2e11ea8.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (9)

.github/workflows/ci.yml
.github/workflows/claude.yml
.github/workflows/codeql-analysis.yml
.github/workflows/coverage.yml
.github/workflows/dependabot-automerge.yml
.github/workflows/nodejs-tests.yml
.github/workflows/playwright-tests.yml
.github/workflows/sonarcloud.yml
SECURITY.md

- Replace permissions: read-all with permissions: {} (deny-by-default) - Use concrete version target (main branch) in SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Jobs using actions/cache and actions/upload-artifact need actions: write permission at the job level to function correctly with deny-by-default workflow permissions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

sonarqubecloud · 2026-03-28T13:18:34Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

* fix: address OpenSSF Scorecard findings - Add SECURITY.md (#85) - Scope workflow token permissions to least privilege (#86) - Pin all GitHub Action dependencies to commit SHAs (#87) - Update vulnerable dependencies via npm audit fix (#88) - Add schedule trigger to CodeQL for full SAST coverage (#89) - Ensure CI and SAST run on all pushes and PRs (#90) Closes #85, #86, #87, #88, #89, #90 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Use concrete version target (main branch) in SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add actions: write permission for cache and artifact jobs Jobs using actions/cache and actions/upload-artifact need actions: write permission at the job level to function correctly with deny-by-default workflow permissions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(ci): apply prettier/eslint auto-fixes * chore: re-trigger CI checks * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

@claude

… code (#465) * Create README.md * Create code.gs * Create config.gs * Update README.md * Update README.md * enhanced Readme * ci: add CodeQL analysis workflow for PRs * feat(tests): add Jest tests, mocks, setup, and CI workflow * docs: add agents.md (canonical AGENTS.md guidance adapted) * docs: normalize to AGENTS.md and add canonical guidance * feat(calendar-to-sheets): add package implementation, tests, and README * chore(calendar-to-sheets): add GAS wrapper (code.gs) and config (config.gs); document files in README * Move scripts into src/, update tests/README/jest config, regenerate coverage * calendar-to-sheets: export GAS wrapper for testing; add test for syncAllCalendarsToSheetsGAS to handle multiple configs * Initial plan * Initial plan * Initial plan * Initial plan * Initial plan * Initial plan * Initial plan * Handle missing or malformed config gracefully - Modified getConfigs() to return legacy/default config when SYNC_CONFIGS is empty array - Added null checks in getCheckpointKey() to handle null cfg - Added null checks in syncAllCalendarsToSheetsGAS() error logging - Added comprehensive tests for empty and malformed SYNC_CONFIGS scenarios - All tests passing Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Initial plan * feat(codeql): upgrade CodeQL action versions to v3 for improved analysis * feat(tests): add tests for full resync functionality and error handling in calendar sync * Initial plan * fix: remove empty lines after unused variable cleanup Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Initial plan * Initial plan * Initial plan * Initial plan * fix(calendar-to-sheets): improve regex to catch leading whitespace/control chars before formula injection Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * test(calendar-to-sheets): cover ensureHeader path * Initial plan * Issue #24 - Add document rebuild capability to gmail-to-drive-by-labels (#25) * Initial plan * Add rebuild doc functionality to gmail-to-drive-by-labels Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Address code review feedback and improve documentation clarity Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Use setText('') for more efficient document clearing Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Update test-utils/mocks.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/gmail-to-drive-by-labels/tests/rebuild.test.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Address code review feedback: fix imports, comments, and add error handling tests Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Implement batching and resumable state for rebuild to handle large labels Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Fix logging message for remaining threads calculation Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Fix syntax error in mocks.js - add missing comma after setText Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Add comprehensive tests for gmail-to-drive-by-labels/code.gs functions Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Improve test coverage with additional edge case tests - 99.48% lines Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Add istanbul ignore comments for uncoverable defensive error handling Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Make rebuild batch size configurable with default of 250 Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Remove istanbul ignore comments and adjust coverage threshold to 99% Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Add rule to AGENTS.md prohibiting coverage ignore comments Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * chore: add pre-commit config, commitlint, and husky hooks for code quality (#35) * Initial plan * Add TypeScript, ESLint, Prettier with CI Pipeline Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Fix CI: upgrade Node.js from 18 to 20 (ESLint 10 requires Node 20+) Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Fix prettier formatting in AGENTS.md Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Fix createThread addLabel using arrow function with this Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Update package.json Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update test-utils/mocks.js Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update .github/workflows/ci.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/calendar-to-sheets/code.gs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Upgrade jest to v30 to align with @types/jest v30 Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Fix prettier CI failure, add husky pre-commit hook with shared check script Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore: add .pre-commit-config.yaml with check-merge-conflict and check-yaml hooks Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * Also enable typecheck in pre-commit hook Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore: add commitlint with conventional commits config and commit-msg hook Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * chore(deps): bump github/codeql-action from 3 to 4 (#41) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v3...v4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 4 to 6 (#43) Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs(agents): add guidance to resolve PR review threads after addressing comments Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Claude Code GitHub Action (#81) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#91) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#85) - Scope workflow token permissions to least privilege (#86) - Pin all GitHub Action dependencies to commit SHAs (#87) - Update vulnerable dependencies via npm audit fix (#88) - Add schedule trigger to CodeQL for full SAST coverage (#89) - Ensure CI and SAST run on all pushes and PRs (#90) Closes #85, #86, #87, #88, #89, #90 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Use concrete version target (main branch) in SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add actions: write permission for cache and artifact jobs Jobs using actions/cache and actions/upload-artifact need actions: write permission at the job level to function correctly with deny-by-default workflow permissions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(ci): apply prettier/eslint auto-fixes * chore: re-trigger CI checks * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#96) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...88c168b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#100) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#101) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable Claude issue trigger per org CI standard (#119) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input - Add dependabot skip condition on step - Add permission comment for contents: write Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#120) * fix: add checkout step to Claude workflow for issue-triggered mode The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * style: apply prettier formatting to claude.yml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency group to dependabot update workflow (#130) Prevents overlapping runs when multiple pushes to main happen in quick succession. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#132) * feat: split Claude workflow into interactive + issue automation jobs Align with org CI standard. The single `claude` job is now split into: - `claude`: interactive mode for PR reviews and @claude mentions - `claude-issue`: automation mode triggered by the `claude` label on issues, with explicit allowed tools, progress tracking, and a structured prompt that implements, opens a PR, self-reviews, checks CI, and notifies owners. Adds `actions: read` and `checks: read` permissions to both jobs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * style: use single quotes for prettier consistency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#134) * chore: add CODEOWNERS file for code owner review enforcement Resolves missing-codeowners compliance finding by adding .github/CODEOWNERS with @don-petry as the default owner for all files in the repository. Closes #113 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#149) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: add codeql.yml with javascript-typescript and actions scanning (#153) Renames codeql-analysis.yml → codeql.yml to satisfy the compliance requirement (issue #103). Updates the configuration to match org standards: - Use javascript-typescript language (required for repos with package.json) - Add actions language (required for repos with .github/workflows/*.yml) - Multi-language matrix strategy with per-language category tags - Weekly schedule aligned to org standard (Friday 17:00 UTC) Closes #103 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support Add @petry-projects-pr-review-agent and @dependabot-automerge-petry as co-owners so their approvals satisfy require_code_owner_review in the pr-quality ruleset. * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.3 (#244) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: standardize CODEOWNERS on @petry-projects/org-leads (#252) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#277) * chore: ignore .dev-lead directory (#291) feat: implement issue #255 — Compliance: codeowners-no-catchall Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * ci: remove drift codeql.yml and enable GitHub-managed default setup (#216) Per ci-standards §2, the GitHub-managed default setup is the required approach for CodeQL scanning. A per-repo codeql.yml is treated as drift by the compliance audit and causes double CI billing when both run. Enabled default setup via API (state=configured, query_suite=default, run_id=24189972152). Removes the inline codeql.yml workflow file. Closes #168 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(deps-dev): bump fast-uri from 3.1.1 to 3.1.2 in the npm_and_yarn group across 1 directory (#263) chore(deps-dev): bump fast-uri Bumps the npm_and_yarn group with 1 update in the / directory: [fast-uri](https://github.com/fastify/fast-uri). Updates `fast-uri` from 3.1.1 to 3.1.2 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.1...v3.1.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * feat: implement issue #254 — Compliance: codeowners-org-leads-not-first (#300) * feat: implement issue #254 — Compliance: codeowners-org-leads-not-first * ci: trigger CI for compliance PR #300 --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #258 — Compliance: check-suite-auto-trigger-347564 (#307) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #442 — SonarCloud modernization (1/3): src/ app code * chore: dev-lead update (review-changes) [skip ci-relay] * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#474) * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github * chore: dev-lead update (review-changes) [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 in the npm_and_yarn group across 1 directory (#469) chore(deps-dev): bump fast-uri Bumps the npm_and_yarn group with 1 update in the / directory: [fast-uri](https://github.com/fastify/fast-uri). Updates `fast-uri` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: petry-projects-dependabot-automrg[bot] <270452309+petry-projects-dependabot-automrg[bot]@users.noreply.github.com> * chore: sync 4 org-standard workflow stub(s) from petry-projects/.github (#479) * chore: sync 4 org-standard workflow stub(s) from petry-projects/.github * chore: sync 4 org-standard workflow stub(s) from petry-projects/.github * chore: sync 4 org-standard workflow stub(s) from petry-projects/.github * chore: sync 4 org-standard workflow stub(s) from petry-projects/.github * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#489) * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don.petry@gmail.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: petry-projects-dependabot-automrg[bot] <270452309+petry-projects-dependabot-automrg[bot]@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 27, 2026 20:45

Copilot started reviewing on behalf of don-petry March 27, 2026 20:45 View session

don-petry mentioned this pull request Mar 27, 2026

Scorecard: Code-Review (0/10) #84

Closed

Copilot AI reviewed Mar 27, 2026

View reviewed changes

Comment thread .github/workflows/nodejs-tests.yml

Comment thread .github/workflows/playwright-tests.yml

coderabbitai Bot reviewed Mar 27, 2026

View reviewed changes

DJ and others added 4 commits March 27, 2026 19:27

fix: address PR review comments

fd41237

- Replace permissions: read-all with permissions: {} (deny-by-default) - Use concrete version target (main branch) in SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore(ci): apply prettier/eslint auto-fixes

86817ca

chore: re-trigger CI checks

6285525

don-petry enabled auto-merge (squash) March 28, 2026 03:25

fix: use claude_code_oauth_token instead of anthropic_api_key

586bcbd

The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

don-petry disabled auto-merge March 28, 2026 13:32

don-petry merged commit 5386727 into main Mar 28, 2026
12 of 13 checks passed

don-petry deleted the scorecard-fixes branch March 28, 2026 13:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: address OpenSSF Scorecard findings - #91

fix: address OpenSSF Scorecard findings#91
don-petry merged 6 commits into
mainfrom
scorecard-fixes

don-petry commented Mar 27, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Mar 27, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

❌ Failed checks (2 inconclusive)

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

sonarqubecloud Bot commented Mar 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

don-petry commented Mar 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Mar 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

❌ Failed checks (2 inconclusive)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Mar 28, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

don-petry commented Mar 27, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Mar 27, 2026 •

edited

Loading