From 5ac0c7d738bd3c091b6ff0104a10f08f85717b0c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:43:05 +0100 Subject: [PATCH 1/2] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + 12 files changed, 12 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 6c15cdb..5bb9e75 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -16,4 +16,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 751e879..aef7e09 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d908a90..b0bcf6c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index a9c9760..0d1e425 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -13,6 +13,7 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 62bbc98..906741d 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -27,6 +27,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 2e7e939..013c95a 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -19,6 +19,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read security-events: write pull-requests: write diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 228dc43..0f86f6c 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -9,6 +9,7 @@ on: types: [published] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 81e9903..c25d3bc 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 0816771..ce036e2 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 4d8e394..3a84116 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -10,6 +10,7 @@ on: pull_request: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 64ac2ac..f0c8699 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: branches: [main] permissions: read-all + actions: read jobs: analysis: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index b3486fc..4839d60 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -11,6 +11,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: From fb122a71eebeb737b4ecb79af24cc40254587444 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 06:22:16 +0100 Subject: [PATCH 2/2] chore: fill or remove RSR template placeholders openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them. Three kinds of change, no invention: The "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment is deleted. The template says to delete it, and it is where every legend line lives -- so a large share of the reported tokens were the file documenting its own placeholders, not real unfilled fields. Tokens derivable from the repository are filled: owner and repo from the git remote, project name, year, forge, main branch, contact email. PGP and website lines are removed rather than filled, because nothing true could go in them. https://github.com/.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasnt uploaded any GPG keys". No key is published for either account here, and commit signing in this estate is SSH, which is unrelated. Only one repository in the estate has a domain, so {{WEBSITE}} likewise has no correct value. The template sanctions this: "Optional: Remove sections that dont apply (e.g. PGP if you dont use it)." A security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- SECURITY.md | 30 ------------------------------ 1 file changed, 30 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0d5fade..1b9d947 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,23 +1,5 @@ # Security Policy - - We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. ## Table of Contents @@ -59,19 +41,8 @@ If you cannot use GitHub Security Advisories, you may email us directly: | | | |---|---| | **Email** | 6759885+hyperpolymath@users.noreply.github.com | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | | **Fingerprint** | `[PGP fingerprint not set]` | -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint 6759885+hyperpolymath@users.noreply.github.com - -# Encrypt your report -gpg --armor --encrypt --recipient 6759885+hyperpolymath@users.noreply.github.com report.txt -``` > **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. @@ -370,7 +341,6 @@ When using Dotmatrix Fileprinter, we recommend: ## Additional Resources -- [Our PGP Public Key]({{PGP_KEY_URL}}) - [Security Advisories](https://github.com/hyperpolymath/dotmatrix-fileprinter/security/advisories) - [Changelog](CHANGELOG.md) - [Contributing Guidelines](CONTRIBUTING.md)