Add GitHub repository security configuration#1
Conversation
- Add explicit permissions: contents: read to ci.yml (principle of least privilege) - Add environment: nuget to publish job (enables manual approval gate) - Add dependabot.yml for weekly NuGet and GitHub Actions updates - Add CodeQL workflow for free static analysis on public repos https://claude.ai/code/session_01RvKpgbtBTikomHFriFx2dA
There was a problem hiding this comment.
Pull request overview
Adds baseline GitHub repository security automation/configuration for this .NET library repo, focusing on least-privilege CI permissions, controlled NuGet publishing, dependency update automation, and CodeQL scanning.
Changes:
- Restricts CI workflow token permissions to
contents: read. - Adds a
nugetenvironment gate to the NuGet publish job. - Introduces Dependabot configuration for weekly NuGet + GitHub Actions updates.
- Adds a CodeQL workflow for scheduled and PR/branch scanning.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/publish.yml | Adds environment: nuget to enable an approval gate for publishing. |
| .github/workflows/codeql.yml | Introduces CodeQL scanning workflow for C#/.NET builds. |
| .github/workflows/ci.yml | Adds explicit workflow permissions (contents: read) for least privilege. |
| .github/dependabot.yml | Configures weekly dependency updates for NuGet projects and GitHub Actions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| schedule: | ||
| - cron: '0 6 * * 1' | ||
|
|
||
| permissions: |
There was a problem hiding this comment.
The CodeQL workflow is missing actions: read in the top-level permissions. GitHub’s recommended minimal permissions for code scanning include actions: read, and without it the CodeQL action/SARIF upload can fail in hardened-permissions setups. Add actions: read alongside contents: read and security-events: write.
| permissions: | |
| permissions: | |
| actions: read |
| with: | ||
| languages: csharp | ||
|
|
||
| - run: dotnet build src/Inflop.VatSharp/Inflop.VatSharp.csproj --configuration Release |
There was a problem hiding this comment.
The build step compiles only src/Inflop.VatSharp/Inflop.VatSharp.csproj, but the repository solution (src/Inflop.VatSharp.slnx) also includes the test project. Building the solution instead will ensure CodeQL extracts/analyses all C# code in the repo and catches compilation issues across projects.
| - run: dotnet build src/Inflop.VatSharp/Inflop.VatSharp.csproj --configuration Release | |
| - run: dotnet build src/Inflop.VatSharp.slnx --configuration Release |
https://claude.ai/code/session_01RvKpgbtBTikomHFriFx2dA