docs(community): quality pass on SECURITY, CONTRIBUTING, CODE_OF_CONDUCT, GOVERNANCE#111
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Quality pass across the org-level community health markdown files so downstream repositories inherit clearer, more actionable guidance for security reporting, contributions, conduct reporting, and governance.
Changes:
- SECURITY.md: restructured reporting guidance, added report-content checklist, supported versions table, response timeline table, and disclosure section.
- CONTRIBUTING.md: added branch naming table, PR checklist, code review expectations, and switched to a GPG or SSH signed commit requirement section.
- CODE_OF_CONDUCT.md and GOVERNANCE.md: updated reporting channels and aligned governance language with a sole-maintainer model.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| SECURITY.md | Adds structured vulnerability reporting guidance, version support and timeline tables, and updated security practices and disclosure text. |
| CONTRIBUTING.md | Replaces the prior contributing guide with expanded contributor workflow guidance, including naming conventions, signing requirements, and review expectations. |
| CODE_OF_CONDUCT.md | Adds email as an additional private reporting channel and updates the last updated date. |
| GOVERNANCE.md | Replaces the multi-role governance model with a sole-maintainer decision process and succession notes. |
| ## Local Development Setup | ||
|
|
||
| 3. **Fork & Clone** | ||
| The exact steps depend on the project, but the typical Python flow is: | ||
|
|
||
| ```bash | ||
| git clone https://github.com/<org>/<repo>.git | ||
| cd <repo> | ||
| git remote add upstream https://github.com/<org>/<repo>.git | ||
| ``` | ||
| ```bash | ||
| git clone https://github.com/ByronWilliamsCPA/<repo>.git | ||
| cd <repo> | ||
| git remote add upstream https://github.com/ByronWilliamsCPA/<repo>.git | ||
|
|
||
| ## Pull Request Guidelines | ||
| python3 -m venv .venv | ||
| source .venv/bin/activate | ||
| uv sync # or: pip install -e ".[dev]" | ||
| pre-commit install # required: installs commit hooks | ||
| pytest # run the test suite | ||
| ``` |
PR Review —
|
williaby
force-pushed
the
claude/review-security-policy-aasG1
branch
from
f6b0a88 to
abb649c
Compare
Fix SummaryAll issues from the automated review and Copilot threads have been addressed in commit b562950 (force-pushed after rebasing onto the independently-fixed remote commit `0e57917`). Copilot threads addressedSECURITY.md — Supported Versions table (#3250919668) SECURITY.md — Semgrep and gitleaks claims (#3250919714)
CONTRIBUTING.md — Python setup presented as universal (#3250919736) All other Critical/Important findings from the review
All pre-commit hooks pass locally. |
PR ReviewCritical (must fix before merge)
Important (should fix)
Review coverage: Copilot not requested via org ruleset. CodeRabbit rate-limited (no content). SonarQube: 0 issues (all changed files are 🤖 Generated with Claude Code |
…ERNANCE - SECURITY.md: add supported-versions table, email contact (byronawilliams@gmail.com), "what to include in a report" section; trim boilerplate Credit section and tighten timeline language. - CONTRIBUTING.md: list full branch prefix set (feature/, fix/, chore/, docs/), add PR checklist and code-review expectations, replace DCO sign-off with an explicit GPG/SSH commit-signing requirement. - CODE_OF_CONDUCT.md: add maintainer email as a reporting channel alongside the existing private Security Advisory link. - GOVERNANCE.md: rewrite to match reality (sole maintainer), describe decision-making, change-proposal process, and succession.
- SECURITY.md: rewrite Supported Versions table to match the repo's actual date-based versioning scheme (CHANGELOG.md uses [YYYY-MM-DD] headers, not semver), and drop the misleading "latest minor" language. - SECURITY.md: correct the Security Practices list to match tooling that is actually wired up; remove gitleaks (not used), keep Semgrep (runs via SonarCloud workflows), and split secret scanning into pre-commit hooks (detect-secrets, TruffleHog) and the GitGuardian PR check. - CONTRIBUTING.md: reframe Local Development Setup so it does not imply every repo is Python; add a shell/bats example and direct contributors to each repo's README and workflows for authoritative commands.
Critical: - SECURITY.md: drop GitGuardian claim (runs as a GitHub App, no workflow in this repo); remove "Semgrep via SonarCloud" wording (the repo only has nosemgrep suppression comments, not active Semgrep scans). Now lists only tooling that is actually wired up here: CodeQL, SonarCloud, Ruff, Bandit, Trivy, detect-secrets, TruffleHog. - SECURITY.md: rebuild Supported Versions table around real tags (v1.0.0 and v1) instead of "most recent dated release tag"; date-based scheme applies to CHANGELOG headers, not git tags. - GOVERNANCE.md: drop hard reference to issue templates and the governance label; templates may not exist downstream, and a missing label would make the instruction unfollowable. Important: - SECURITY.md: fix timeline overlap. Critical-fix target is now 14 calendar days from acknowledgement (not from end of triage), and triage for critical is shortened to 2 business days. - CONTRIBUTING.md: add fork step to the clone instructions; external contributors cannot push to the org. - CONTRIBUTING.md: add the claude/ prefix to the branch-naming table (used by automated agents in this repo). - CONTRIBUTING.md: clarify that branch protection enforces signing at merge to main, not at push to a feature branch. - CODE_OF_CONDUCT.md: remove Security Advisory as a conduct-report channel; email is the only correct path. Cross-link to SECURITY.md for vulnerability reports.
SECURITY.md: - Supported Versions: remove "dated release tag" wording; actual tags are semver (v1.0.0). Remove false "no numbered releases" claim. - Response Timeline: clarify fix windows run from triage completion, not from the initial report date. - Security Practices: replace "Semgrep (via SonarCloud)" with accurate "SonarCloud (incorporates Semgrep rule patterns)". - Security Practices: replace "GitGuardian on PRs" (no workflow exists) with "GitHub secret scanning (enabled by default on public repos)". CONTRIBUTING.md: - Local Development Setup: add fork step before clone; external contributors cannot push to the org URL directly. - GPG-Signed Commits Required: clarify enforcement fires at merge to main, not at push to a feature branch. CODE_OF_CONDUCT.md: - Reporting: replace GitHub Security Advisory link (wrong tool for conduct reports) with GitHub abuse reporting link. GOVERNANCE.md: - How to Propose a Change: remove "using the appropriate template" reference; no issue templates exist in this repo. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
williaby
force-pushed
the
claude/review-security-policy-aasG1
branch
from
b562950 to
57a31f3
Compare
SECURITY.md: - Remove contradicting "from triage completion" prose; all fix windows run from acknowledgement as the table already states. - Clarify Bandit and Ruff scope: these apply to downstream Python repos via the Python reusable workflows, not to this repo directly. CONTRIBUTING.md: - Soften GPG enforcement claim: branch protection is not configured; restate as org policy rather than platform-enforced gate. - Fix "show as Verified" checklist item to distinguish signing action from GitHub-side badge display. - Add uv install reference in Python example setup block. - Expand chore/ branch prefix to cover refactor, test-only, and style changes alongside tooling and CI. - Add private-repo fork caveat: external contributors cannot fork private repositories. GOVERNANCE.md: - Fix security-fixes cross-reference: SECURITY.md describes reporter timelines, not internal merge policy; reword to avoid implying it does. - Anchor the seven-day waiting period to the issue creation date so the clock is auditable. - Scope succession fork rights to public repositories; private repos cannot be forked by external contributors. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
/pr-fix SummaryCommit 0fefc99 addresses all 10 auto-fixable findings from the Critical fixes
Important fixes
Suggested fixes
Copilot thread responsesAll three Copilot inline comments are addressed:
Human-only items (reviewer confirmation required)
|
Summary
Quality pass on the org-level community health files. These apply to all repos in the org that do not provide their own versions.
SECURITY.md
v1.0.0,v1) rather than a fictional "date-based release tag" scheme.detect-secrets, TruffleHog. Removed gitleaks (not used), GitGuardian (no workflow in this repo), and "Semgrep" framed as an active scanner (onlynosemgrep:suppression comments exist).CONTRIBUTING.md
feature/,fix/,chore/,docs/, and a reservedclaude/for automated agents).Signed-off-byrequirement with an explicit GPG-signed commits required section. Wording clarified: branch protection enforces signing at merge tomain, not at push to a feature branch.CODE_OF_CONDUCT.md
GOVERNANCE.md
governancelabel, since neither is guaranteed to exist on every downstream repo.Test plan
scripts/check-no-em-dash.shpasses on staged files).markdownlintclean against.markdownlint.yml.main(was one commit behind; new tip inmainonly touched workflow YAML, no overlap).byronawilliams@gmail.comis the correct contact address to publish.