chore: harden public repository - #83
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR hardens the repository for public visibility by improving security/contribution guidance, strengthening issue intake, and tightening GitHub Actions supply-chain and permissions posture.
Changes:
- Added SECURITY.md and CONTRIBUTING.md, plus structured issue templates and an expanded PR checklist emphasizing synthetic data and private vuln reporting.
- Updated README.md to clarify product scope, privacy model, limitations, setup, and operational guidance for public users.
- Pinned GitHub Actions to immutable commit SHAs, introduced dependency review, and set explicit least-privilege workflow permissions.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| SECURITY.md | Adds a clear private vulnerability reporting policy and scope notes suitable for a public repo. |
| README.md | Reframes docs around scope, privacy model, setup, automation, and public-facing safety guidance. |
| CONTRIBUTING.md | Adds contributor expectations, setup steps, testing guidance, and source citation requirements. |
| .github/workflows/pslmodels-snapshot-monitor.yml | Pins actions to SHAs for workflow supply-chain hardening. |
| .github/workflows/pre-commit-autoupdate.yml | Pins actions to SHAs for workflow supply-chain hardening. |
| .github/workflows/dependency-review.yml | Adds dependency review workflow with minimal permissions. |
| .github/workflows/ci.yml | Pins actions to SHAs and sets explicit default workflow permissions. |
| .github/pull_request_template.md | Expands checklists to include synthetic-data/privacy and source-link expectations. |
| .github/ISSUE_TEMPLATE/feature_request.yml | Adds a structured feature request template emphasizing synthetic examples and sources. |
| .github/ISSUE_TEMPLATE/config.yml | Disables blank issues and routes security reports to private advisories. |
| .github/ISSUE_TEMPLATE/bug_report.yml | Adds a structured bug report template with privacy confirmation and source/evidence fields. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ShoGinn
added a commit
that referenced
this pull request
Aug 1, 2026
## Summary - rewrite the README around product scope, privacy, safety, and reproducible setup - add contribution, security, and structured issue-reporting guidance - pin all GitHub Actions to immutable commit SHAs - add dependency review and explicit least-privilege workflow permissions ## Validation - `uv run pre-commit run --all-files` - pre-push backend tests, frontend type checking, and frontend tests - Gitleaks full-history scan: 0 findings - TruffleHog local-only full-history scan: 0 findings ## Notes GitHub Secret Scanning, Push Protection, private vulnerability reporting, Dependabot, and default CodeQL scanning are enabled at the repository level.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
uv run pre-commit run --all-filesNotes
GitHub Secret Scanning, Push Protection, private vulnerability reporting, Dependabot, and default CodeQL scanning are enabled at the repository level.