chore: org hardening — SHA-pinned CI gate, Dependabot, CODEOWNERS, SECURITY, CONTRIBUTING - #63
Merged
Merged
Conversation
Until now nothing checked a pull request before it reached main: the only build of the site was Cloudflare Workers Builds on the push to main, so a broken change surfaced as a failed deploy after the merge. This workflow runs on pull_request and on push to main with the same install and build the deploy performs (bun install --frozen-lockfile, bun run build), then astro check and the data-layer tests. The job is named `build` so a required status check on main can reference it. Hardening details: - actions are pinned to full commit SHAs with a `# vX.Y.Z` trailer (actions/checkout v7.0.1, oven-sh/setup-bun v2.2.0); Dependabot's github-actions ecosystem keeps them current. - permissions: contents: read only, and checkout uses persist-credentials: false because no later step pushes or calls the API, so the token is never left in .git/config. - setup-bun rather than setup-node + npm ci: the repo is a Bun project (bun.lock, engines.bun >= 1.3, scripts run `bun scripts/*.ts`) and has no package-lock.json, so npm ci could not install it. - build runs before check: astro check type-checks imports of the gitignored src/data/generated/*.json that build:data emits. Org hardening review 2026-09-06.
The site had no Dependabot configuration, so neither its JavaScript dependencies nor the action SHAs the new CI workflow pins would ever be proposed for update. Both ecosystems run weekly and are grouped into one PR per run: this is a static site with no runtime server, so a daily PR stream buys nothing. typescript is deliberately pinned to exactly 6.0.3 because @astrojs/check breaks on TypeScript 7 and drifting the pin would ship the site with no type-check gate. An ignore rule excludes semver-major and semver-minor updates for it so only patch releases of the 6.0 line are proposed. Dependabot's npm ecosystem reads package.json + bun.lock, so it covers a Bun-installed project without any extra configuration. Org hardening review 2026-09-06.
Lets GitHub request review from the owner on every pull request and lets the main ruleset require a code-owner approval before merge. Includes a commented example of delegating an area to a co-maintainer so the format is obvious when the first delegation happens. Org hardening review 2026-09-06.
SECURITY.md gives reporters a private channel: the repository's Security tab -> "Report a vulnerability" (private vulnerability reporting is enabled on this repo) as the preferred route, security@goceleris.dev as the alternative, with a 72-hour acknowledgement commitment. It scopes the policy to the site build pipeline and hosting configuration and points engine reports at celeris/SECURITY.md, which owns the supported-versions table. CONTRIBUTING.md documents how to run the site locally with Bun, what CI runs (build, astro check, bun test), the PR flow, the pinned-typescript and results/-is-publisher-owned rules, and the merge rule: green `build` job plus a code-owner approval. Org hardening review 2026-09-06.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
goceleris-docs | 5adc264 | Commit Preview URL Branch Preview URL |
Sep 05 2026, 11:12 PM |
…deps The npm entry could not do what its comment claimed. Dependabot's `npm` ecosystem is dependabot-core's npm_and_yarn, which reads package-lock.json, yarn.lock and pnpm-lock.yaml and never bun.lock (its file fetcher has no Bun code path); Bun is a separate ecosystem, `bun`, with its own fetcher and bun.lock parser. Pointed at this repo, npm would have seen a manifest-only project: no PRs for the ^-ranged dependencies until a new major shipped, and the one exact pin (typescript 6.0.3) would have got a patch PR that edited package.json without refreshing bun.lock, so the `bun install --frozen-lockfile` step of the `build` CI job would have failed on every Dependabot npm PR. Switch the entry to `package-ecosystem: bun` (GitHub: Bun >= 1.1.39, text lockfile). directory, weekly schedule, the typescript semver-major/minor ignore, the all-js-deps group and the `deps` commit prefix carry over unchanged. The comment now states the actual mechanism and records the one caveat: the bun ecosystem does version updates only, so Dependabot security alerts on JS dependencies do not auto-generate PRs here. Verified against dependabot-core (common/lib/dependabot/config/file.rb maps "npm" => "npm_and_yarn" and "bun" => "bun"; bun/lib/dependabot/bun/ is a separate ecosystem; npm_and_yarn's file_fetcher.rb has zero Bun references) and GitHub's supported-ecosystems table. dependabot.yml still parses and both entries are in the SchemaStore dependabot-2.0 enum.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
File-based follow-ups from the org hardening review 2026-09-06 for
goceleris/docs. No workflow semantics change;sync-benchmarks.ymlis untouched (see below). GitHub settings/rulesets are handled separately and are not part of this PR.Changes and rationale
.github/workflows/ci.yml(new) — jobbuild:actions/checkout→oven-sh/setup-bun→bun install --frozen-lockfile→bun run build→bun run check→bun test, onpull_requestandpushtomain,permissions: contents: read, concurrency-cancel on superseded PR runs, 20-minute timeoutmain; the only build was Cloudflare Workers Builds after the merge, so a broken change surfaced as a failed deploy. The job is namedbuildso a required status check onmaincan reference it.# vX.Y.Ztrailer:actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1,oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0object.type: commit), so the SHA is the commit itself; the floatingv7/v2tags resolve to the same commits.persist-credentials: falseon checkoutGITHUB_TOKENshould not be left in.git/configfor later steps.setup-buninstead ofsetup-node+npm cibun.lockonly, nopackage-lock.json,engines.bun >= 1.3, scripts runbun scripts/*.tsdirectly), sonpm cicannot install it.bun-version: latestmirrors what Cloudflare Workers Builds uses;package.jsononly sets a floor.buildruns beforecheckastro checktype-checks imports of the gitignoredsrc/data/generated/*.jsonthatbuild:dataemits; run in the other order it fails with 6ts(2307)errors (verified locally)..github/dependabot.yml(new) —npmweekly (grouped) with anignorefortypescriptversion-update:semver-major+semver-minor;github-actionsweekly (grouped)typescriptstays exactly6.0.3because@astrojs/checkbreaks on TypeScript 7; only patch releases may be proposed. Thegithub-actionsentry is what keeps the new SHA pins current. Weekly cadence: static site, no runtime server..github/CODEOWNERS(new) — header,* @FumingPower3925, commented area-delegation examplemainruleset require a code-owner approval.SECURITY.md(new)security@goceleris.devas the alternative; acknowledgement within 72 hours; scope = build pipeline, published content, dashboard island, hosting config; points engine reports atceleris/SECURITY.md, which owns the supported-versions table.CONTRIBUTING.md(new)typescriptandresults/-is-publisher-owned rules, and the merge rule (greenbuildjob + code-owner approval).sync-benchmarks.yml— no change neededThe existing workflow has no
uses:steps at all (a singlerun:step that echoes the dispatch payload) and no checkout, so there is nothing to SHA-pin and nopersist-credentialsto set. Itspermissions: contents: readalready matches the hardening baseline. Left byte-identical.Verification
actionlinton both workflows: clean.python3 -c 'import yaml'parse ofci.yml,sync-benchmarks.yml,dependabot.yml: valid.grep -rnE 'uses: [^./][^@]*@v' .github/workflows: no matches outside comments.gh api repos/<owner>/<repo>/git/ref/tags/<tag>(bothobject.type: commit, no annotated-tag dereference needed); floatingv7/v2confirmed to point at the same SHAs.bun install --frozen-lockfile✓,bun run build✓ (Pagefind indexed 28 pages),bun run check✓ (0 errors, 0 warnings, 12 pre-existing hints),bun test✓ (16 pass, 0 fail).bun.lockunchanged.Because the workflow triggers on
pull_request, thebuildcheck runs on this PR itself; after merge it can be added as a required status check onmain.