docs: Adopt GitHub Private Vulnerability Reporting Workflow#477
docs: Adopt GitHub Private Vulnerability Reporting Workflow#477Aloui-Ikram wants to merge 3 commits into
Conversation
Implements the reference version of goharbor/community#292 on harbor-next: - SECURITY.md: supported-versions table, concrete response targets (ack 3 business days, triage 7 days, critical fix 14 business days, disclosure within 90 days), reporter expectations (advisory collaboration, CVE, credit), fallback for reporters without a GitHub account, and a known-CVE deflection rule. - docs/security-process.md: maintainer runbook covering intake, triage with CVSS severity ladder, embargoed fix in a temporary private fork, in-band CVE request via GitHub as CNA, coordinated disclosure, release-note conventions, and a per-advisory checklist. - .github/ISSUE_TEMPLATE/bug_report.yml: warning at the top telling reporters not to file security vulnerabilities as public issues. - .github/workflows/codeql.yml: CodeQL scanning for Go and TypeScript (build-mode none, security-extended queries). - .typos.toml: allow the CNA acronym. Signed-off-by: aloui ikram <ikram@container-registry.com>
|
Warning Review limit reached
Next review available in: 47 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthroughThe pull request updates vulnerability reporting guidance, adds a maintainer security-response runbook, accepts ChangesSecurity Reporting Process
CodeQL Analysis
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
documentation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
|
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/codeql.yml (1)
17-19: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueConsider preserving in-progress scans on the default branch.
Setting
cancel-in-progress: trueunconditionally will cancel running scans for earlier commits when a new push tomainoccurs. While this saves runner minutes, it may result in some merged commits not having their own specific scan results attached to the default branch history. It is generally recommended to only cancel in-progress runs on pull requests.💡 Proposed refactor to only cancel on PRs
concurrency: group: codeql-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true + cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml around lines 17 - 19, Update the workflow’s concurrency configuration so cancel-in-progress is enabled only for pull request runs and disabled for pushes to the default branch. Preserve the existing CodeQL concurrency group and ensure scans triggered by main commits are allowed to complete.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 25-26: Add contents: read and actions: read to the job-level
permissions block alongside security-events: write, preserving the existing
permission while allowing actions/checkout and the CodeQL action to access the
repository.
In @.typos.toml:
- Around line 25-26: Change the dictionary exception key in the
[default.extend-words] configuration from uppercase CNA to lowercase cna,
preserving the mapped value and existing security terminology comment.
---
Nitpick comments:
In @.github/workflows/codeql.yml:
- Around line 17-19: Update the workflow’s concurrency configuration so
cancel-in-progress is enabled only for pull request runs and disabled for pushes
to the default branch. Preserve the existing CodeQL concurrency group and ensure
scans triggered by main commits are allowed to complete.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f5fe9cbc-8f3a-4035-9e36-facf6b457605
📒 Files selected for processing (5)
.github/ISSUE_TEMPLATE/bug_report.yml.github/workflows/codeql.yml.typos.tomlSECURITY.mddocs/security-process.md
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 5 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
- Go does not support build-mode none (fails on CodeQL 2.26.1); use autobuild for Go, keep none for JS/TS. - Job-level permissions override workflow read-all: add actions: read and contents: read alongside security-events: write. - typos lowercases words before dictionary lookup: extend-words key must be lowercase (cna). Signed-off-by: aloui ikram <ikram@container-registry.com>
The lowercase key made typos treat cna as a typo with correction CNA, flagging every legitimate CNA occurrence (error: CNA should be CNA). The uppercase form passed CI on the first run; restore it. Signed-off-by: aloui ikram <ikram@container-registry.com>
|
Hi @bupd, could you please review this PR when you have time? Thanks! |
2 participants
Reference implementation of goharbor/community#292 on harbor-next: replace
mailing-list-based security reporting with GitHub private vulnerability
reporting (PVR) and repository security advisories, so upstream goharbor/harbor
can adopt a proven, tested setup.
What's in this PR
direct link, issue chooser)
within 7 calendar days, critical fix within 14 business days, coordinated
disclosure within 90 days
GitHub, credit
go to the public tracker, dependency findings to the dependency-update flow
CVSS severity ladder, embargoed fix in a temporary private fork, in-band
CVE request (GitHub as CNA), coordinated disclosure, release-note
conventions, and a per-advisory checklist
build-mode
none, security-extended queries, SHA-pinned actions (this PRtriggers its first run)
security reports away from public issues (adopted from docs: switch security reporting to GitHub private vulnerability reporting goharbor/harbor#23559)
Where the ideas come from
Each design choice follows a reference project studied for this work:
Verified
key finding: triaging reports requires an org security-manager team or
admin — currently a single-admin bottleneck (follow-up: org-level setup,
outside this PR's scope)
Out of scope
Org-level admin steps (security-manager team, org-wide PVR default,
automated security fixes) ; tracked separately.
Related: goharbor/community#292, goharbor/harbor#23559