fix: publish an org-default security policy - #17
Merged
Conversation
Four repositories had no security policy at all — harn-adventures, heroiclands-site, package-build and this one. Not because anyone decided they needed none, but because a per-repository file is one more thing to remember when a repository is created, and a default is remembered by construction. package-build is the one that mattered. It executes during every consuming package's build and is published to npm, which makes it the organisation's highest-value supply-chain target, and it had no policy, no chooser entry and no private reporting. The file carries no repository-specific URL and no relative link, because a default is rendered for many repositories and can name none of them: a relative link resolves against this repository, not the one displaying it, so `.github/ISSUE_REPORTING.md#7` would 404 for every inheritor. A repository publishing its own keeps it whole — GitHub does not merge the two. The issue-chooser config.yml is deliberately NOT defaulted, though GitHub supports it as one. Its private-reporting entry is a contact_link holding a literal URL with no templating, so a single default would send every repository's reporter to whichever repository was hardcoded — which is the exact bug that opened #14, where harn-ensemble's chooser pointed at sohl-kethira-basic. Defaulting the chooser would institutionalise that rather than fix it. This closes the file half only. Private vulnerability reporting is a repository setting that no pull request can change, and it is still off in nine of the ten eligible repositories while six advertise it. The README records the API call that enables it and the check that confirms it. Refs #14
Closed
3 tasks
Both branches appended a README section immediately before `actions/labels`, so git could not tell which order was intended. Keeping both: the two reusable workflows stay adjacent and `SECURITY.md` follows them, ahead of the composite actions. No content from either side is dropped, and the net change against main is the two files this branch adds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix: publish an org-default security policy
Four repositories had no security policy at all — harn-adventures,
heroiclands-site, package-build and this one. Not because anyone decided they
needed none, but because a per-repository file is one more thing to remember
when a repository is created, and a default is remembered by construction.
package-build is the one that mattered. It executes during every consuming
package's build and is published to npm, which makes it the organisation's
highest-value supply-chain target, and it had no policy, no chooser entry and no
private reporting.
The file carries no repository-specific URL and no relative link, because a
default is rendered for many repositories and can name none of them: a relative
link resolves against this repository, not the one displaying it, so
.github/ISSUE_REPORTING.md#7would 404 for every inheritor. A repositorypublishing its own keeps it whole — GitHub does not merge the two.
The issue-chooser config.yml is deliberately NOT defaulted, though GitHub
supports it as one. Its private-reporting entry is a contact_link holding a
literal URL with no templating, so a single default would send every
repository's reporter to whichever repository was hardcoded — which is the exact
bug that opened #14, where harn-ensemble's chooser pointed at
sohl-kethira-basic. Defaulting the chooser would institutionalise that rather
than fix it.
This closes the file half only. Private vulnerability reporting is a repository
setting that no pull request can change, and it is still off in nine of the ten
eligible repositories while six advertise it. The README records the API call
that enables it and the check that confirms it.
Refs #14