[don-petry]

Summary

1. Removes the local SECURITY.md in combsmith/.github-private so it inherits the canonical org-wide policy in combsmith/.github/SECURITY.md directly.
2. Updates scripts/seed-repo-template.sh so new and templated repositories do not receive a 6-line local SECURITY.md pointer stub that shadows combsmith/.github/SECURITY.md and drops OpenSSF Scorecard Security-Policy scores from 10/10 to 9/10.

Problem

When a repository defines a local SECURITY.md, both GitHub and OpenSSF Scorecard evaluate only that local file and ignore combsmith/.github/SECURITY.md. Because seed-repo-template.sh (_gen_baseline) previously emitted a 6-line SECURITY.md pointer stub, every templated repository failed Scorecard's securityPolicyContainsVulnerabilityDisclosure probe (9/10, e.g., combsmith/incubator#17, combsmith/repo-template#6, combsmith/empower-personal-dashboard#59), whereas repositories without a local SECURITY.md inherit combsmith/.github/SECURITY.md and score 10/10.

Risk

Low — removing "SECURITY.md|gen" from BASELINE_MANIFEST stops seeding the 6-line stub into combsmith/repo-template; existing repositories are updated via companion PRs.

Test plan

• bats tests/test_seed_repo_template.bats
• shellcheck -S warning -s bash scripts/seed-repo-template.sh

Rollback

Revert this PR commit to restore SECURITY.md generation in seed-repo-template.sh.

Monitoring

Verify org-scorecard.yml in combsmith/.github resolves github.com/combsmith/.github/SECURITY.md (10/10) across templated repositories.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T00:40:46.917687Z	79b2e65	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e8dd78c4-a1dd-462b-bcb0-b602d409fcf3

Commits

Reviewing files that changed from the base of the PR and between 6188f56 and 79b2e65.

Files selected for processing: 6

• README.md
• SECURITY.md
• scripts/seed-repo-template.sh
• tests/fixtures/seed-repo-template/repo-template-BOOTSTRAP.md
• tests/fixtures/seed-repo-template/repo-template-README.md
• tests/test_seed_repo_template.bats

Files with no reviewable changes: 1

• SECURITY.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Summary

Summary by CodeRabbit

• Documentation
  • Updated the contribution guidance to link to the organization-wide security policy.
  • Updated repository-template documentation and file listings to reflect that SECURITY.md is inherited organization-wide rather than included in the template.
• Tests
  • Updated template checks to verify the revised baseline file list.

The README now links to the organization-wide Security Policy. The seeder no longer generates SECURITY.md, and its baseline documentation, fixtures, and tests reflect that policy inheritance.

Changes: Security policy inheritance

Layer / File(s)	Summary
Policy link and seeded baseline README.md, SECURITY.md, scripts/seed-repo-template.sh, tests/fixtures/seed-repo-template/*, tests/test_seed_repo_template.bats	The README links to the organization-wide Security Policy. The seeder no longer includes or generates SECURITY.md; its generated inventories, fixtures, and tests now describe the policy as inherited organization-wide.

Priority: Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: Minimal · up to 79b2e

The policy inheritance change is consistent across documentation, seeding, fixtures, and tests.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (3 skipped: 3…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: removing the local SECURITY.md and stopping its generation in the repository template.
Description check		The description includes the required Summary, Problem, Risk, Test plan, Rollback, and Monitoring sections. It provides specific rationale, validation commands, rollback guidance, and monitoring detai…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes the required Summary, Problem, Risk, Test plan, Rollback, and Monitoring sections. It provides specific rationale, validation commands, rollback guidance, and monitoring details. The optional Interaction contract section is appropriately omitted because this PR does not change an agentic role.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (3 skipped: 3 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud