ci(security): add CodeQL, Dependabot, and OSV-Scanner bundle#11
Conversation
Replicates the security scanner bundle from paybot-core PR #3 (merged 2026-05-22, squash 6dc6f5aa) to paybot-sdk. Key difference from paybot-core: paybot-sdk is PUBLIC, so SARIF upload to the Security tab is free without GitHub Advanced Security. Both CodeQL and OSV-Scanner use the simpler `upload: true` form — no artifact workaround needed. Files added: - .github/workflows/codeql.yml — SAST, weekly Monday 06:00 UTC - .github/workflows/osv-scanner.yml — vuln DB, weekly Tuesday 06:00 UTC - .github/dependabot.yml — npm + github-actions, weekly Monday Anti-patterns applied (from paybot-core PR #3): - AP #2: OSV pinned to exact tag @v2.2.1 (not @v2 alias) - AP #3: OSV permissions at workflow level (not job level) - AP #4: required_status_checks update deferred until exact context names captured verbatim from `gh pr checks` post first run Governed by .claude/rules/automated-pr-merge-authority.md (NON-NEGOTIABLE). Refs: RBKunnela/paybot-core#3
WalkthroughThree GitHub security automation workflows are added: Dependabot automatically updates npm and GitHub Actions dependencies weekly with PR limits and scoped commit messages; CodeQL runs static analysis on JavaScript/TypeScript with security-extended queries and uploads results; OSV-Scanner scans lockfiles for known vulnerabilities using Google's reusable workflow. ChangesCI/Security Automation Setup
🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a .github/dependabot.yml configuration to automate weekly dependency updates for npm and GitHub Actions. Feedback focuses on a discrepancy between the PR description and the actual changes, specifically the absence of mentioned security scanner workflows (CodeQL and OSV-Scanner). Additionally, it is recommended to implement grouped updates for both ecosystems to minimize the manual overhead of the project's strict merge process.
| @@ -0,0 +1,47 @@ | |||
| # Dependabot — automated dependency PRs for paybot-sdk | |||
There was a problem hiding this comment.
The PR title and description indicate that this PR adds a "security scanner bundle" including CodeQL (.github/workflows/codeql.yml) and OSV-Scanner (.github/workflows/osv-scanner.yml) workflows. However, these files are missing from the current diff. Please ensure all components of the bundle are included in the PR.
| labels: | ||
| - "dependencies" | ||
| - "npm" |
There was a problem hiding this comment.
Given the strict merge process described in the PR summary (requiring a 12-check matrix pass and manual merge by @devops), receiving multiple individual PRs for dependency updates every week could lead to significant process overhead. Consider using Dependabot's grouped updates feature to bundle these into a single PR. This would allow the team to run the QA matrix once for the entire set of weekly updates.
labels:
- "dependencies"
- "npm"
groups:
npm-dependencies:
patterns:
- "*"| labels: | ||
| - "dependencies" | ||
| - "github-actions" |
There was a problem hiding this comment.
Similar to the npm ecosystem, grouping GitHub Actions updates can help reduce the number of PRs that need to go through the manual QA and merge process.
labels:
- "dependencies"
- "github-actions"
groups:
action-dependencies:
patterns:
- "*"![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/codeql.yml (1)
47-48: ⚡ Quick winAdd
persist-credentials: falseto the Checkout step to reduce token exposure.
.github/workflows/codeql.ymlcurrently hasactions/checkout@v4at lines 47-48, and there’s nopersist-credentials: falsesetting present.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml around lines 47 - 48, Add the persist-credentials: false setting to the Checkout step named "Checkout" that uses actions/checkout@v4 so the workflow does not persist the GITHUB_TOKEN in the checked-out repository; locate the step with uses: actions/checkout@v4 (the "Checkout" step) and add the persist-credentials: false option under that step.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 47-60: Update the workflow steps that use mutable action tags:
replace uses: actions/checkout@v4 and uses: github/codeql-action/init@v3,
github/codeql-action/autobuild@v3, github/codeql-action/analyze@v3 with their
corresponding immutable 40-character commit SHAs, and in the Checkout step add
with: persist-credentials: false to avoid persisting the default token;
specifically edit the steps named "Checkout", "Initialize CodeQL", "Autobuild",
and "Perform CodeQL Analysis" to pin the uses: fields to exact commit SHAs and
add the persist-credentials: false key under the Checkout step's with block.
In @.github/workflows/osv-scanner.yml:
- Line 56: The workflow references the OSV reusable workflow using a mutable tag
in the uses string
("google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.2.1");
replace that tag with the corresponding immutable commit SHA for the
google/osv-scanner-action repository (e.g.,
.github/workflows/osv-scanner-reusable.yml@<COMMIT_SHA>) so the action content
is pinned; locate the uses line in .github/workflows/osv-scanner.yml and update
it to the commit SHA obtained from the upstream repo (ensure the SHA matches the
desired v2.2.1 state).
---
Nitpick comments:
In @.github/workflows/codeql.yml:
- Around line 47-48: Add the persist-credentials: false setting to the Checkout
step named "Checkout" that uses actions/checkout@v4 so the workflow does not
persist the GITHUB_TOKEN in the checked-out repository; locate the step with
uses: actions/checkout@v4 (the "Checkout" step) and add the persist-credentials:
false option under that step.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: e44456e6-6fc3-4ac5-80f4-813cd1134e23
📒 Files selected for processing (3)
.github/dependabot.yml.github/workflows/codeql.yml.github/workflows/osv-scanner.yml
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| queries: security-extended | ||
|
|
||
| - name: Autobuild | ||
| uses: github/codeql-action/autobuild@v3 | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Non-SHA pinned uses in CodeQL workflow:"
rg -nP '^\s*uses:\s*[^@]+@(?!(?:[0-9a-f]{40})\b).+$' .github/workflows/codeql.ymlRepository: RBKunnela/paybot-sdk
Length of output: 287
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Relevant section of .github/workflows/codeql.yml:"
nl -ba .github/workflows/codeql.yml | sed -n '35,80p'Repository: RBKunnela/paybot-sdk
Length of output: 175
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Relevant section of .github/workflows/codeql.yml (lines 35-80):"
awk 'NR>=35 && NR<=80 {printf "%d:%s\n", NR, $0}' .github/workflows/codeql.ymlRepository: RBKunnela/paybot-sdk
Length of output: 1073
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Searching for persist-credentials / permissions in .github/workflows/codeql.yml:"
rg -n --hidden -S "persist-credentials|permissions:" .github/workflows/codeql.ymlRepository: RBKunnela/paybot-sdk
Length of output: 161
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Relevant section of .github/workflows/codeql.yml (lines 15-45):"
awk 'NR>=15 && NR<=45 {printf "%d:%s\n", NR, $0}' .github/workflows/codeql.ymlRepository: RBKunnela/paybot-sdk
Length of output: 836
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n --hidden "persist-credentials" .github/workflows/codeql.yml || trueRepository: RBKunnela/paybot-sdk
Length of output: 46
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Non-SHA pinned uses in CodeQL workflow:"
rg -nP '^\s*uses:\s*[^@]+@(?!(?:[0-9a-f]{40})\b).+$' .github/workflows/codeql.ymlRepository: RBKunnela/paybot-sdk
Length of output: 287
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Non-SHA pinned uses in CodeQL workflow:"
rg -nP '^\s*uses:\s*[^@]+@(?!(?:[0-9a-f]{40})\b).+$' .github/workflows/codeql.ymlRepository: RBKunnela/paybot-sdk
Length of output: 287
Pin CodeQL workflow GitHub Actions to immutable commit SHAs (and harden checkout credentials)
.github/workflows/codeql.ymluses mutable action tags:actions/checkout@v4,github/codeql-action/{init,autobuild,analyze}@v3``; pin each to its 40-char commit SHA to prevent supply-chain drift.- The
actions/checkoutstep does not setwith: persist-credentials: false; add it to avoid persisting the default token in git config.
Suggested hardening diff
- - name: Checkout
- uses: actions/checkout@v4
+ - name: Checkout
+ uses: actions/checkout@<40-char-commit-sha>
- - name: Initialize CodeQL
- uses: github/codeql-action/init@v3
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@<40-char-commit-sha>
- - name: Autobuild
- uses: github/codeql-action/autobuild@v3
+ - name: Autobuild
+ uses: github/codeql-action/autobuild@<40-char-commit-sha>
- - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v3
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@<40-char-commit-sha>🧰 Tools
🪛 zizmor (1.25.2)
[warning] 47-48: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 48-48: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 51-51: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 57-57: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 60-60: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 47 - 60, Update the workflow steps
that use mutable action tags: replace uses: actions/checkout@v4 and uses:
github/codeql-action/init@v3, github/codeql-action/autobuild@v3,
github/codeql-action/analyze@v3 with their corresponding immutable 40-character
commit SHAs, and in the Checkout step add with: persist-credentials: false to
avoid persisting the default token; specifically edit the steps named
"Checkout", "Initialize CodeQL", "Autobuild", and "Perform CodeQL Analysis" to
pin the uses: fields to exact commit SHAs and add the persist-credentials: false
key under the Checkout step's with block.
| jobs: | ||
| scan: | ||
| # AP #2: exact tag, not `@v2` major alias. | ||
| uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.2.1" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Non-SHA pinned uses in OSV workflow:"
rg -nP '^\s*uses:\s*[^@]+@(?!(?:[0-9a-f]{40})\b).+$' .github/workflows/osv-scanner.ymlRepository: RBKunnela/paybot-sdk
Length of output: 192
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "osv-scanner workflow context (lines 40-80):"
nl -ba .github/workflows/osv-scanner.yml | sed -n '40,80p'
echo
echo "All non-SHA pinned `uses:` in this workflow:"
rg -nP '^\s*uses:\s*[^@]+@(?!(?:[0-9a-f]{40})\b).+$' .github/workflows/osv-scanner.ymlRepository: RBKunnela/paybot-sdk
Length of output: 169
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/osv-scanner.yml"
echo "File line count:"
wc -l "$FILE"
echo
echo "osv-scanner workflow context (lines 45-70):"
awk 'NR>=45 && NR<=70 {printf "%d:%s\n", NR, $0}' "$FILE"
echo
echo "All non-SHA pinned `uses:` in this workflow:"
rg -nP '^\s*uses:\s*[^@]+@(?!(?:[0-9a-f]{40})\b).+$' "$FILE"Repository: RBKunnela/paybot-sdk
Length of output: 1073
Pin OSV reusable workflow uses: to an immutable commit SHA (not @v2.2.1).
The workflow calls:
google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.2.1
Tags are mutable, so the referenced workflow content can change without this repo updating.
Suggested hardening diff
- uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.2.1"
+ uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@<40-char-commit-sha>"🧰 Tools
🪛 zizmor (1.25.2)
[error] 56-56: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/osv-scanner.yml at line 56, The workflow references the
OSV reusable workflow using a mutable tag in the uses string
("google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.2.1");
replace that tag with the corresponding immutable commit SHA for the
google/osv-scanner-action repository (e.g.,
.github/workflows/osv-scanner-reusable.yml@<COMMIT_SHA>) so the action content
is pinned; locate the uses line in .github/workflows/osv-scanner.yml and update
it to the commit SHA obtained from the upstream repo (ensure the SHA matches the
desired v2.2.1 state).
|
Merge authorization per
CodeRabbit CHANGES_REQUESTED dismissed: findings are tech-debt (SHA-pinning), tracked as Task #12 across all 3 paybot repos. Same posture as paybot-core PR #3 (merged 2026-05-22 with @qa PASS, identical pattern). Non-blocking observations from @qa:
Post-merge actions:
|
…, proposal cleanup) (#28) * chore(hygiene+hardening): SHA-pin actions, CODEOWNERS, uv ecosystem, prune proposal Bundle of four backlog items for paybot-sdk supply-chain + governance hygiene: #5 Delete stale .github/workflows/ci.yml.proposed (speculative draft from earlier experimentation; left dead in tree, creates confusion when reading workflows). #6 Add .github/CODEOWNERS routing all paths to @RBKunnela (solo-founder phase). Removes the duplicate root /CODEOWNERS — .github/CODEOWNERS takes precedence per GitHub's discovery order, so the root file would be dead-ignored. #11 Add `uv` ecosystem block to dependabot.yml covering /packages/python. Variance from task spec (which said `pip`): the live evidence — Dependabot's own auto-opened PR #12 on this repo carrying `package-manager=uv` — proves Dependabot natively understands the uv.lock format. Using `pip` would only cover pyproject.toml manifests and miss lockfile-pinned transitive deps. #12 SHA-pin all GitHub Actions references across ci.yml, codeql.yml, and osv-scanner.yml to 40-char immutable commit SHAs with adjacent `# vX` comments preserving floating-tag intent for Dependabot upgrades. Adds `persist-credentials: false` to checkout steps where applicable. The `npm publish` job in ci.yml intentionally omits it (OIDC GITHUB_TOKEN must remain for `--provenance`). Resolutions (gh api repos/<owner>/git/refs/tags/<v>): actions/checkout@v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 actions/setup-node@v4 -> 49933ea5288caeca8642d1e84afbd3f7d6820020 github/codeql-action/*@V3 -> 03e4368ac7daa2bd82b3e85262f3bf87ee112f57 osv-scanner-reusable.yml@v2.2.1 -> 456ceb78310755116e0a3738121351006286b797 CodeRabbit on PR #11 (squash 2513676) flagged action pinning as MAJOR tech-debt; this closes that finding. Precedent: paybot-core sibling PR (parallel hygiene-and-hardening track, same convocation). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(codeowners): preserve path-partitioned reviewer rules from pre-existing root CODEOWNERS Restore the /packages/python/ rule routing reviews to both @RBKunnela and @kite-builds. Operator confirmed 2026-05-22 that this rule is intentional (specialized reviewer for the Python port), not stale — reversing the prior session decision that flagged it for removal. Other path rules from the deleted root CODEOWNERS (/src/, /examples/) routed to @RBKunnela only and were therefore functionally equivalent to the `*` catch-all. Not restored — restoring them would add noise without changing review routing. Operator's amendment spec also omits them, aligning with this reading. If review routing for those paths needs to differ from the catch-all in future, partition then. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Why:
Mon 2026-05-25 06:00 UTC Dependabot wave projected to ~50 individual
PRs across the 3 paybot repos. Solo-founder bandwidth cannot absorb.
Groups batch into ~12-15 PRs total.
What:
npm ecosystem: 5 groups
- npm-patch-prod / npm-minor-prod (version-updates, prod, split by risk)
- npm-dev-deps (version-updates, dev, batched freely)
- npm-security-patch / npm-security-minor (security-updates, split by severity)
uv ecosystem (packages/python): 4 groups
- uv-patch / uv-minor (version-updates)
- uv-security-patch / uv-security-minor
(uv lacks the dependency-type axis npm has, so groups split by
update-type alone; severity split preserved for security updates.)
Precedent: scanner-bundle PRs paybot-core #3 (6dc6f5aa), paybot-sdk #11
(2513676), paybot-mcp #1 (a6c211db) — same gate model.
Authority: full SINKRA chain per .claude/rules/automated-pr-merge-authority.md.
@qa lightweight (CI green + YAML validity + schema correct) then @devops merge.
DO NOT MERGE before @qa PASS.
Deadline: must merge before Mon 2026-05-25 06:00 UTC.
2 participants
Summary
Replicates the security scanner bundle from paybot-core PR #3 (merged 2026-05-22, squash
6dc6f5aa) to paybot-sdk.This PR is governed by
.claude/rules/automated-pr-merge-authority.md(NON-NEGOTIABLE rule established 2026-05-22). Only@devopsmay merge, and only after@qaissues a PASS verdict under the 12-check matrix.Why
Closes the highest-leverage gap on paybot-sdk: it is the most public-facing of the three paybot repos (npm-published, reaches end-developers' machines). Bringing it under the same scanner regime as paybot-core means consumer-facing supply-chain CVEs become visible and flow into the automated PR pipeline.
What each scanner does
.github/workflows/codeql.yml)security-extendedqueries.github/workflows/osv-scanner.yml).github/dependabot.yml)Public-repo simpler form (vs paybot-core)
Key difference from paybot-core PR #3: paybot-sdk is public. Public repos get GitHub-native Code Scanning (SARIF upload to Security tab) and Dependabot for free, without GitHub Advanced Security.
So this PR uses the simpler
upload: trueform on both CodeQL and OSV-Scanner — no GHAS workarounds needed. paybot-core (private personal-account) requiredupload: false+actions/upload-artifactfor SARIF preservation; that workaround does NOT appear here.If/when paybot-sdk becomes private, switch back to the paybot-core pattern. Until then, the simpler form is the right default.
Anti-patterns applied (from paybot-core PR #3 hard-won learnings)
@v2major-version alias is invalid (only exact tags exist)@v2.2.1; Dependabot github-actions ecosystem will surface upgradespermissions:on reusable-workflow callers silently droppedosv-scanner.ymlgh pr checks <PR>once first run completesAP #1 (GHAS-SARIF gating) explicitly does not apply here — public repo, native upload is free.
Dependabot API enabled
The two endpoints have been called in the correct order (vulnerability-alerts BEFORE automated-security-fixes):
Both returned success. Dependabot will back-scan the lockfile and surface any pre-existing CVEs imminently (paybot-core surfaced 22 alerts the moment alerts were enabled — paybot-sdk may produce a similar wave).
SINKRA chain integration
Per
automated-pr-merge-authority.md, this PR is routed:.github/. Same carve-out as paybot-core PR 🤝 Founding Contributors — Join the open agent payment protocol #3.Do NOT enable auto-merge on this PR. Do NOT merge until @qa issues PASS and @devops verifies the audit trail.
Follow-up work (NOT in this PR)
gh pr checks <pr-num> --repo RBKunnela/paybot-sdk(AP Founding 10 Contributors Program — Support Open Agent Commerce #4 — verbatim, no reformatting). Then PATCH branch protection on main to add the new checks alongside the existingbuild (18)+build (20).npm test+npm run lintto ci.yml — Task Founding 10 Contributors Program — Support Open Agent Commerce #4 from the post-PR-🤝 Founding Contributors — Join the open agent payment protocol #3 backlog; CI currently runs typecheck + build only.Reference
6dc6f5aa, 2026-05-22).claude/rules/automated-pr-merge-authority.md(NON-NEGOTIABLE).aios/handoffs/handoff-2026-05-22-paybot-security-hardening.mdConvoked by @aiox-master. Authored by @devops (Gage). Awaiting @qa validation.
Summary by CodeRabbit
Chores