Repository navigation
[v1.0] Enable repository secret, dependency, and code-scanning controls #280
Description
Goal
Enable defense-in-depth repository controls for vulnerable dependencies, committed secrets, and static code-scanning findings.
Background
Live repository settings on 2026-08-30 report dependabot_security_updates disabled and secret scanning, non-provider patterns, push protection, and validity checks disabled. The code-scanning alerts endpoint reports that no analysis exists.
The repository's Ruff, Bandit, pip-audit, redaction, and threat-model gates are valuable, but they do not prevent a credential from being pushed, open reviewed security-update pull requests, or provide CodeQL-style cross-file analysis.
Scope
- Enable the dependency graph, Dependabot alerts/security updates, and a reviewed update policy.
- Enable secret scanning, push protection, validity checks, and supported non-provider patterns.
- Enable CodeQL default or advanced setup for the supported Python surface.
- Make actionable security checks required on protected
main. - Document triage, false-positive dismissal, SLA, and emergency response ownership.
- Record any organization/plan control that cannot be enabled and its compensating control.
Acceptance Criteria
- Repository settings read back the intended dependency, secret, and code-scanning features as enabled.
- A safe test secret pattern is blocked or detected in a documented rehearsal.
- Code scanning produces a successful analysis for
mainand pull requests. - Dependabot security updates open a reviewed PR when a test fixture/rehearsal dependency is vulnerable, or equivalent evidence proves configuration.
- Security checks are required by branch protection and cannot be silently skipped on release-source changes.
- Dismissals require reason, reviewer, and audit trail; ownership and remediation SLAs are documented.
- Existing Bandit and
pip-auditgates remain in place and are not treated as substitutes for repository controls.
Validation
Read back GitHub security settings and branch protection; inspect the first successful code-scanning run; execute safe secret/dependency rehearsal cases; verify alert and dismissal workflows.
Non-Goals
- Do not commit a real credential or known exploitable production dependency.
- Do not replace the runtime threat model, trusted publishing, or artifact attestations.
Dependencies
- [v1.0] Gate releases on protected main lineage and independent approval #271
- [v1.0] Pin and verify the release build toolchain #278
Project Fields
- Status: Backlog
- Priority: P1
- Area: Security
- Initiative: v1.0 Readiness
- Size: M
Ownership
- Assignee: @codeforester
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
codeforester commentedon Sep 1, 2026
Live review readback (2026-09-01, main
1df8bc4): Dependabot security updates, secret scanning, non-provider-pattern scanning, push protection, and validity checks remain disabled; the code-scanning alerts endpoint reports no analysis. Local Bandit,pip check, and pip-audit were clean, but those do not replace repository controls. This issue remains a v1.0 release blocker.codeforester commentedon Sep 12, 2026
2026-09-12 repository review refresh
Live repository metadata still reports secret_scanning=disabled, secret_scanning_push_protection=disabled and dependabot_security_updates=disabled. Local Bandit and strict pip-audit passed in the review but do not replace these hosted controls. This remains an administrative/security follow-up, not a reason to claim a known exploitable dependency was found.
Validated against current main (
7faf347a5b90969e169c88f3ac18e7202d142dd0). This review files and scopes work; it does not claim implementation or authorize release/admin changes.codeforester commentedon Oct 22, 2026
Implementation evidence is in PR #463: #463
The repository now has pinned CodeQL workflow and Dependabot configuration, and the live settings read back as dependabot security updates enabled, secret scanning enabled, and push protection enabled. GitHub CodeQL is green on the PR branch. GitHub currently reports non-provider secret patterns and validity checks as plan-limited/disabled; the PR documents those compensating controls. Main-branch CodeQL and making that context required remain post-merge verification steps. The issue remains In Review pending review/merge.
codeforester commentedon Oct 23, 2026
Review follow-up completed in PR #463. Dependabot now targets the uv ecosystem so updates include uv.lock, and the security-threat-model heading is unambiguous. Commit: 2395c91. All review threads are resolved.