docs(github-project): repo-level Actions/security hardening + API gotchas#83
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
…PI gotchas Add an "Actions & Security Hardening" section to repo-bootstrap.md covering the per-repo Actions permissions surface that init-branch-protection.sh does not touch: default_workflow_permissions=read, can_approve_pull_request_reviews=false, allowed_actions=selected + sha_pinning_required, the fork-pr-contributor-approval policy, and the Dependabot / private-vulnerability-reporting / secret-scanning push-protection toggles. Add a "GitHub Security API: Scripting Gotchas" section to security-config.md: post-create eventual-consistency 404 retry, the 204-vs-2xx probe quirk, the secret_scanning pairing requirement, settings with no per-repo REST API, and the free-plan-private 403. Endpoint shapes verified against AriESQ/gh-safe-repo. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
CybotTM
force-pushed
the
docs/actions-hardening-from-gh-safe-repo
branch
from
f78e6e4 to
0ea23f2
Compare
There was a problem hiding this comment.
Pull request overview
Adds documentation for repo-level GitHub Actions permissions and security hardening toggles, plus a section on GitHub Security API scripting gotchas, to complement the existing init-branch-protection.sh coverage.
Changes:
- New "Actions & Security Hardening" section in
repo-bootstrap.mdcovering workflow token defaults, allowed-actions/SHA pinning, fork-PR approval policy, and security toggles. - New "GitHub Security API: Scripting Gotchas" section in
security-config.mddocumenting eventual-consistency 404s, 2xx status quirks, thesecret_scanningPATCH pairing requirement, missing per-repo REST endpoints, and free-plan 403s.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| skills/github-project/references/repo-bootstrap.md | Adds an Actions & Security Hardening section with gh api commands and gotchas. |
| skills/github-project/references/security-config.md | Adds a Scripting Gotchas section for the GitHub Security API. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds documentation on GitHub Actions security hardening and API scripting gotchas to repo-bootstrap.md and security-config.md. The review feedback correctly identifies that the sha_pinning_required parameter is only supported at the organization level rather than the repository level, and provides corrections for the API call and its explanation. Additionally, the feedback points out that there is no standalone GET endpoint for private vulnerability reporting, which must instead be checked via the main repository object.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Summary
Adds the repo-level Actions permissions and security toggle surface that
init-branch-protection.shdoes not cover, plus a set of GitHub Security API scripting gotchas. Sourced from an assessment of AriESQ/gh-safe-repo; every endpoint was verified against that tool'splugins/actions.py/plugins/security.py, not memory.references/repo-bootstrap.md— new "Actions & Security Hardening" sectiondefault_workflow_permissions=read+can_approve_pull_request_reviews=false(/actions/permissions/workflow)allowed_actions=selected+sha_pinning_required(/actions/permissions), incl. theenabled=true-or-422 and apply-order-before-/selected-actionsgotchasfork-pr-contributor-approvalpolicy (public-only) with its three enum valuesorg-security-settings.md)references/security-config.md— new "GitHub Security API: Scripting Gotchas"secret_scanningmust accompanysecret_scanning_push_protectionor the PATCH is silently ignoredTest plan
markdownlint-cli2clean on both changed files