Repository navigation
ci: add OpenSSF Scorecard, dependency review and a security policy - #520
Merged
Merged
Conversation
The repository had no private route for reporting a vulnerability, and CONTRIBUTING.md sends every problem to public issues. GitHub shows SECURITY.md on the Security tab, and Scorecard's Security-Policy check reads it. The supported version rule follows from how releases work rather than from a new promise: every release is cut from main, main tracks the newest Angular major, and version:set ties the package major to it, so there is no branch an older major could receive a fix on. Reporting goes through GitHub private vulnerability reporting so that no address has to be published and the follow-up lives in a draft advisory.
Scorecard measures the supply chain checks a consumer would otherwise have to take on trust, such as pinned actions, token permissions and branch protection, and reports them to code scanning. The permission shape and the step list are dictated by the Scorecard API, which rejects published results from a workflow with write permissions at the top level, id-token outside the analysis job, or an action outside its approved list. publish_results makes the result queryable at api.scorecard.dev; no README badge is added for now. Actions are pinned by commit SHA because Pinned-Dependencies scores a tag as unpinned, and a tag can be moved after review.
Dependabot raises an alert only once a vulnerable version is already on main. Dependency review fails a check on the pull request that would introduce it, so the problem shows before the merge. The check blocks merging only once it is a required status check in branch protection. The token stays read-only, so the pull request comment mode, which needs pull-requests: write, stays at its default of off and the result shows in the job summary.
CONTRIBUTING.md told contributors to report every problem as a public issue, which contradicts SECURITY.md. A contributor who reads only CONTRIBUTING.md would disclose a vulnerability before a fix exists.
While a series is open, main carries the candidate and only the stable release that closes the series moves latest. A fix made then can only ship as the next candidate: version:set writes the Angular peer ranges from the major it is given, so an 18.x cut from a workspace on Angular 19 would declare Angular 18 peers for code built against 19. The 19.0.0 series ran from 17 to 26 August, rc.0 to rc.4 and then the stable release, with latest on 18.3.0 and no 18.x release in between. A replaced candidate is not patched, which docs/execution-plan.md records for the 19.0.0 series, so only those stay in the not backported list.
✅ Deploy Preview for ajsf ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
hamzahamidi
marked this pull request as ready for review
September 22, 2026 23:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a private route for reporting vulnerabilities, an OpenSSF Scorecard run on
mainand a dependency review check on pull requests.Changes
SECURITY.mdsends reports to GitHub private vulnerability reporting and says fixes ship in the next release frommain, a candidate onnextduring an open candidate series.CONTRIBUTING.mdpoints vulnerabilities there.scorecard.ymlfollows the OpenSSF template.dependency-review.ymlfails a check when a pull request adds a vulnerable dependency, and blocks merging only once it is a required status check. Actions are pinned by commit SHA.The report link fails until the maintainer enables private vulnerability reporting under Settings, Advanced Security.
Release impact
None: CI and repository docs only.
Validation
npm run test:scriptson Node 24.21.0 passed 73 specs, including the workflow guards over both workflows. All 6 action pins matched their tags throughgh api. The workflows have not run; actionlint was unavailable.