ci: add security and quality hardening workflows#38
ci: add security and quality hardening workflows#38kaio6fellipe wants to merge 14 commits intomainfrom
Conversation
Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
…orts formatter Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
…eck to v1.1.4 Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 37 minutes and 15 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (16)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
OpenSSF Scorecard — 8.4/10 ✅
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
The gitleaks GitHub Action requires a paid license for organization repositories. Replace with direct CLI binary installation. Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Convert all workflows to permissions: {} at workflow level with
per-job grants. This maximizes the OpenSSF Scorecard Token-Permissions
check (0/10 -> 10/10).
Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Pin setup-packer@main to v3.2.0 SHA to improve the OpenSSF Scorecard Pinned-Dependencies check. Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Resolves revive stutter lint violations. The package name already provides the namespace (ec2.API, sqs.Sender). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Extract validateRequiredEnv, loadSecrets, cleanupStaleInstances, and reconcileOrphanInstances helpers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Mark PrivateKey struct field as non-hardcoded credential and annotate SSRF findings on GitHub API HTTP calls with controlled URLs. Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
Fork PRs don't have write access to the GITHUB_TOKEN, so the comment step would fail with 403. Skip it for forks — the scorecard check and threshold enforcement still run. Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
2 participants
Summary
lambda/build)lambda/module)@kaio6fellipeas default ownerContext
Replicates security and quality configurations from event-driven-bookinfo. All actions SHA-pinned. Least-privilege permissions throughout. Keeps existing Renovate config (no Dependabot).
CodeQL uses explicit
cd lambda && go build ./...instead of autobuild to ensure thelambda/go.modmodule is correctly discovered. Govulncheck runs withworking-directory: lambda.Spec:
docs/superpowers/specs/2026-04-20-security-quality-hardening-design.mdin code-agent-hub.Test plan
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com