Summary
CodeRabbit identified security and correctness issues in the consolidated documentation.yml workflow (PR #1317). This issue tracks fixes for:
Issues Identified
Security
- Overly broad workflow permissions (scope to individual jobs)
- Missing persist-credentials flags on checkout steps
- Shell script variable handling security
Correctness
- Maintenance report misrepresents outcomes (shows success when scripts fail)
- README resolver over-includes root README on every change
- Documentation lacks clarity on output format (comma-separated vs space-separated)
Solution
Branch: fix/workflows-documentation-security-hardening
Changes Included
- Job-scoped permissions — Remove overly broad top-level permissions; scope to audit, regenerate, maintain jobs
- persist-credentials flags — Set to false for read-only (audit), true for write operations
- Maintenance report accuracy — Track individual step outcomes; display actual success/failure status
- README resolver optimization — Only add root README when subdirectory files change
- Enhanced documentation — Comments explaining output format, execFileSync security rationale
Related Issues
Definition of Ready (DoR)
Definition of Done (DoD)
Related issues: #1227, #1309, #1310, #1317
Summary
CodeRabbit identified security and correctness issues in the consolidated documentation.yml workflow (PR #1317). This issue tracks fixes for:
Issues Identified
Security
Correctness
Solution
Branch:
fix/workflows-documentation-security-hardeningChanges Included
Related Issues
Definition of Ready (DoR)
Definition of Done (DoD)
Related issues: #1227, #1309, #1310, #1317