Add branch-protection tooling + security/CI/AI-SDLC hardening#2
Merged
Conversation
- setup/Protect-MainBranch.ps1 creates a main-protection ruleset (require PR + lint check, merge queue, block force-push/deletion), with a payload-builder unit test and a README (run once on a new repo, then delete the folder). - Remove .config/scripts/Enable-MergeQueue.* (superseded by the fuller ruleset). - Point .github/README.md and AGENTS.md at the new setup/ tooling. - Bump CI actions off deprecated Node 20 (checkout@v7, setup-python@v6, cache@v6). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Governance & PR flow: - CODEOWNERS for control surfaces only (no catch-all) - PR template with mandatory Evidence section; issue forms (bug/feature) - Ruleset: require review-thread resolution; enable auto-merge + delete-branch-on-merge; opt-in admin-exempt strict layer (-WithStrictLayer) - setup/Enable-RepoSecurity.ps1: secret scanning + push protection, Dependabot alerts/fixes, private vuln reporting, read-only workflow token, Actions allowlist + required SHA pinning - setup/AI-Maintainer-Identity.adoc: least-privilege agent identity KB Supply chain & workflow security: - SHA-pin all actions; zizmor hook; persist-credentials:false - Full-history gitleaks scan in CI (staged-only local hook is a no-op there) - Dependabot: 7-day cooldown; pip ecosystem for the semgrep pin Policy checks: - semgrep as a per-commit local hook (PyPI wheel; managed clone breaks on Windows) + monthly registry scan workflow - PSScriptAnalyzer custom rule Measure-RequireStrictMode; Set-StrictMode retrofitted across all scripts (caught one real bug in Enable-RepoSecurity) - Bootstrap: install asciidoctor when Ruby is present Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
DenWin
changed the title
Semgrep was briefly wired in as an active pre-commit hook + scheduled CI scan; reverting that back to an inert overlay. Reasons: the managed pre-commit hook doesn't clone on Windows (case-colliding paths), and PowerShell rule execution is Pro-gated (free tier silently reports 0 findings) with Pro capped at 10 repos account-wide - unsuitable for a template cloned into many repos. Tracking issue for a replacement: #3 - .pre-commit-config.yaml: remove the semgrep hook - .github/: remove semgrep-scheduled.yml, requirements-semgrep.txt, the Dependabot pip entry - .config/overlays/semgrep/: activation-only (README + hook fragment) - .config/semgrep/rules/: the two verified rules stay as real, tracked config, renamed to match their rule id (python-/bash- prefix) - .config/overlays/semgrep-pro/: documents the Pro-tier gate Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Goal
Two related deliverables on one branch: (1) the one-time branch-protection tooling (
setup/Protect-MainBranch.ps1), and (2) the concepts worth keeping from the ai-lab review — governance (CODEOWNERS, PR/issue templates), supply-chain hardening (SHA pins, zizmor, full-history secret scan), policy checks (semgrep, PSSA custom rule), and setup tooling for repo security and AI-maintainer identity.Scope
setup/—Protect-MainBranch.ps1(ruleset: PR + lint check + merge queue + thread resolution; auto-merge/branch-cleanup; opt-in admin-exempt-WithStrictLayer),Enable-RepoSecurity.ps1(secret scanning, Dependabot, PVR, read-only token, Actions allowlist + SHA-pinning requirement), AI-maintainer identity KB (AsciiDoc), tests for all of it.github/— CODEOWNERS (control surfaces only), PR template with mandatory Evidence, issue forms, gitleaks full-history CI step, scheduled semgrep workflow, SHA-pinned actions, Dependabot cooldown + pip ecosystem.pre-commit-config.yaml— zizmor and semgrep hooks.config/— semgrep policy rules, PSScriptAnalyzer custom rule (Measure-RequireStrictMode),Set-StrictModeretrofit across all scripts, asciidoctor in bootstrapDeliberately not included: repo-level squash-only (would bind admin bypass too), code-owner review enforcement (deferred until AI-maintainer identities exist),
required_linear_history(contradicts admin merge-method freedom).Risk & rollback
Low-to-moderate. The semgrep hook and zizmor add new commit-time gates — a false-positive rule blocks commits; mitigation: delete/adjust the rule in
.config/semgrep/rules/. TheSet-StrictModeretrofit changes runtime semantics of all scripts — covered by the test suite (34 tests green) and it already surfaced+fixed one latent bug. Applied-live repo settings (auto-merge, Actions allowlist + SHA pinning) are outside this diff and reversible via onegh apicall each. Rollback of the diff: revert the branch's two commits; no migrations.Evidence
gh apiGET🤖 Generated with Claude Code