security: codify GitHub Security Advisories workflow#18
Merged
Conversation
Co-authored-by: seonghobae <8172694+seonghobae@users.noreply.github.com> Agent-Logs-Url: https://github.com/seonghobae/vector-topic-modeling/sessions/f8db517e-d4b9-4769-934f-4d3097b24c82
Copilot
AI
changed the title
[WIP] Establish workflow for GitHub Security Advisories vulnerability response
security: codify GitHub Security Advisories workflow
Mar 25, 2026
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (10)
Cache: Disabled due to Reviews > Disable Cache setting Disabled knowledge base sources:
📝 WalkthroughSummary by CodeRabbit릴리즈 노트
WalkthroughGitHub Security Advisories를 공식 비공개 취약점 접수·심사·공개 워크플로우로 도입하는 새 문서와 관련 문서(SECURITY.md, ARCHITECTURE.md 등) 참조 추가, 릴리스·배포 절차 연계, 교차문서 검증용 단위 테스트 추가. Changes
Sequence Diagram(s)sequenceDiagram
participant Reporter as Reporter
participant GHSA as "GitHub Security\nAdvisories (Private)"
participant Triage as Triage Owner
participant Fix as Fix Owner
participant CI as CI/Release Pipeline
participant Release as Release Owner
participant Public as Public Advisory / CHANGELOG
Reporter->>GHSA: 보고서 제출(양식, 재현 정보, 영향 범위)
GHSA->>Triage: 알림 / 초기 접수
Triage->>Fix: 우선도·심각도 지정 및 작업 할당
Fix->>CI: 수정 PR + 회귀 테스트 요청
CI->>Fix: 빌드/검증 결과
Fix->>Release: 패치 릴리스 아티팩트 준비
Release->>Public: 릴리스 아티팩트 게시
Release->>GHSA: Advisory 게시(메타데이터 확인, fixed version)
GHSA->>Public: Advisory 공개 및 CHANGELOG 참조
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@SECURITY.md`:
- Around line 12-14: The SECURITY.md fallback currently says "contact the
maintainer directly" with no contact info; update that section (the line
starting "If GitHub Security Advisories is temporarily unavailable, contact the
maintainer directly with:") to include at least one explicit contact
method—e.g., a monitored security email (security@yourdomain.com), a link to a
security.txt or vulnerability disclosure page, and optional PGP key or secure
form URL—so reporters have a working channel when GitHub Advisories are down.
In `@tests/test_security_advisories_governance.py`:
- Around line 18-40: The test
test_security_advisories_workflow_contains_required_sections only checks
presence of fragments; change it to validate ordering by computing positions in
content (e.g., using content.find(fragment) or content.index(fragment)) for each
fragment in the tuple and asserting that each subsequent position is greater
than the previous; also add an explicit ordered check that the "artifact" →
"Advisory" → "CHANGELOG" sequence appears in the right order by finding those
specific substrings and asserting their indices are strictly increasing; update
assertions to raise clear failures when any fragment is missing or out-of-order.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: cfcee2f5-b020-4daa-9e73-867f0df88e58
📒 Files selected for processing (10)
AGENTS.mdARCHITECTURE.mdSECURITY.mddocs/agents/README.mddocs/engineering/acceptance-criteria.mddocs/maintainers/releasing.mddocs/operations/deploy-runbook.mddocs/security/api-security-checklist.mddocs/security/security-advisories-workflow.mdtests/test_security_advisories_governance.py
Owner
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
Owner
|
@coderabbitai review |
seonghobae
approved these changes
Mar 25, 2026
Owner
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Security advisory workflow docs and governance tests verified; review feedback addressed with explicit fallback contact channels and sequencing-order assertions.
Owner
|
@coderabbitai review |
Owner
|
@coderabbitai resolve |
✅ Actions performedReview triggered.
|
Owner
|
@coderabbitai full review |
✅ Actions performedReview triggered.
|
✅ Actions performedFull review triggered. |
Owner
|
@coderabbitai pause |
Owner
|
@coderabbitai resume |
✅ Actions performedComments resolved and changes approved. |
✅ Actions performedReviews paused. |
✅ Actions performedReviews resumed. |
Copilot AI
added a commit
that referenced
this pull request
Mar 25, 2026
Mirror PR #18 (commit be7e849) changes on fresh Copilot branch. - Add docs/security/security-advisories-workflow.md with canonical intake-to-disclosure process, SLAs, sequencing, rehearsal log - Update SECURITY.md with private reporting form URL, SLA targets, and link to workflow doc - Update AGENTS.md with security advisory workflow maintenance rule - Update ARCHITECTURE.md with GitHub Security Advisories reference - Update docs/agents/README.md with vulnerability routing rules - Update docs/engineering/acceptance-criteria.md with security governance reference - Update docs/maintainers/releasing.md with security advisory release gate - Update docs/operations/deploy-runbook.md with security advisory release coordination - Update docs/security/api-security-checklist.md with advisory governance linkage - Add tests/test_security_advisories_governance.py (5 CI enforcement tests) Fixes #16 Fixes #19 Co-authored-by: seonghobae <8172694+seonghobae@users.noreply.github.com> Agent-Logs-Url: https://github.com/seonghobae/vector-topic-modeling/sessions/daec77aa-539e-4e54-93e9-e5a65a7415f9
This was referenced Mar 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No standardized process existed for private vulnerability intake, triage, patching, and coordinated disclosure. This establishes GitHub Security Advisories as the canonical channel with documented SLAs and sequencing rules enforced by CI.
New
docs/security/security-advisories-workflow.md— canonical intake-to-disclosure process: roles, private reporting, triage/severity, private fix flow, publish order (artifacts → advisory → changelog), dependency advisory handling, and a tabletop rehearsal log entrytests/test_security_advisories_governance.py— 5 tests that continuously enforce cross-document policy linkage and required section presence in CIUpdated
SECURITY.md— private reporting form URL, SLA targets (3-day ack / 5-day triage), link to workflow doc; removes fallback-first framingdocs/maintainers/releasing.md— adds## Security advisory release gate(Draft advisory check, publish sequencing, CHANGELOG entry with GHSA/CVE reference)docs/operations/deploy-runbook.md— adds## Security advisory release coordination(artifacts → advisory → version metadata verification)docs/security/api-security-checklist.md— advisory governance linkage for provider-adjacent vulnerabilitiesARCHITECTURE.md,AGENTS.md,docs/agents/README.md,docs/engineering/acceptance-criteria.md— cross-reference the new workflow doc; agents doc explicitly prohibits directing reporters to public issuesOriginal prompt
📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.
📝 Walkthrough
걸어보기
GitHub Security Advisories를 기반으로 한 취약점 제보, 심사, 수정, 공개를 위한 표준화된 보안 대응 워크플로우를 확립하는 문서 업데이트입니다. 새로운 보안 워크플로우 문서를 추가하고, 기존 보안 정책 및 릴리스/배포 절차 문서들을 이와 연계하도록 갱신했습니다.
변경 사항
SECURITY.md,ARCHITECTURE.md,AGENTS.mddocs/security/security-advisories-workflow.md를 지정했습니다.docs/security/security-advisories-workflow.mddocs/maintainers/releasing.md,docs/operations/deploy-runbook.md,docs/agents/README.md,docs/security/api-security-checklist.md,docs/engineering/acceptance-criteria.mdtests/test_security_advisories_governance.py예상 코드 리뷰 노력
🎯 2 (단순) | ⏱️ ~12분
시