docs(security): add SECURITY.md pointer — closes 2 alerts + un-reds check-critical - #641
Merged
Merged
Conversation
Three things are currently broken by the absence of a literal
SECURITY.md, and one file fixes all of them:
* code-scanning alert #705 hypatia/scorecard/SecurityPolicy
* code-scanning alert #704 hypatia/cicd_rules/missing_requirement
* scorecard-enforcer.yml's check-critical job, which runs
`if [ ! -f "SECURITY.md" ]` and has been FAILING ON EVERY PUSH
(confirmed on the 2026-08-24 and 2026-08-25 runs)
The repo has a full 12KB SECURITY.adoc plus SECURITY-ADVISORIES.adoc; the
policy is not missing, only the filename these checks look for. Every
community-health doc in this estate is .adoc by deliberate convention.
A pointer rather than a copy, so there stays exactly one source of truth.
Both alerts come from Hypatia, whose SARIF pipeline is LIVE (alerts
updated 2026-08-24), so they will close on the next scan. Note this is
NOT true of the 12 Scorecard-sourced alerts in this repo, which are
frozen at 2026-06-03 — see the separate finding on that.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three things are currently broken by the absence of a literal
SECURITY.md, and one pointer file fixes all of them:hypatia/scorecard/SecurityPolicyhypatia/cicd_rules/missing_requirementscorecard-enforcer.yml→check-criticalif [ ! -f "SECURITY.md" ]and fails on every push — confirmed on the 2026-08-24 and 2026-08-25 runsThe policy is not missing. This repo has a full 12KB
SECURITY.adocplusSECURITY-ADVISORIES.adoc. Only the filename those checks look for is absent, because every community-health document in this estate is.adocby deliberate convention.A pointer, not a copy — so there stays exactly one source of truth and the policy can't drift between two files.
Why these two will actually close
Both are Hypatia-sourced, and Hypatia's SARIF pipeline is live (its alerts were updated 2026-08-24). They'll clear on the next scan.
scorecard-reusable.ymlemitsresults_format: jsonwith noupload-sarifstep, so nothing has fed the code-scanning tab for nearly three months. That is a separate finding with its own remediation.The alternative I did not take
Teaching the Hypatia rule and the enforcer script to accept
SECURITY.adocis the more consistent long-term answer and is worth doing. It changes two pieces of shared infrastructure rather than adding one file, so it belongs in its own change rather than bundled into a red-CI fix.🤖 Generated with Claude Code