Repository navigation
chore(security): remove local SECURITY.md to inherit org-wide policy - #646
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including
 |
| Layer / File(s) | Summary |
|---|---|
Update security policy reference README.md, SECURITY.md |
The README links to the organization-wide security policy. The repository’s security policy file, which documented reporting guidance and response targets, is removed. |
Priority:
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Other
Merge Risk: 
0159a
-
No actionable merge-blocking risk remains.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title names the primary change: the local SECURITY.md is removed so the organization-wide security policy is inherited. The raw summary confirms the file deletion and the README link update, and t… Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title names the primary change: the local SECURITY.md is removed so the organization-wide security policy is inherited. The raw summary confirms the file deletion and the README link update, and the PR objectives state the same intent. The 'chore(security):' prefix is a conventional-commit type and scope, which is acceptable and does not make the title vague.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches: 💡 1
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
|
Summary
Removes the local
SECURITY.mdincombsmith/google-app-scriptsso the repository inherits the canonical org-wide security policy incombsmith/.github/SECURITY.mddirectly (10/10on OpenSSF Scorecard).Problem
When a repository defines a local
SECURITY.md, both GitHub and OpenSSF Scorecard evaluate only that local file and ignorecombsmith/.github/SECURITY.md. Removing the local file allows both GitHub's Security tab andscorecard --repo="github.com/combsmith/google-app-scripts"to resolvecombsmith/.github/SECURITY.mdautomatically (10/10).Risk
Low — documentation cleanup only; org-wide policy in
combsmith/.github/SECURITY.mdtakes effect immediately upon merge.Test plan
scorecard --reporesolvesgithub.com/combsmith/.github/SECURITY.md(10/10) when no localSECURITY.mdis present.Rollback
Revert this PR commit.
Monitoring
Verify
org-scorecard.ymlresolvesgithub.com/combsmith/.github/SECURITY.md(10/10) on the next scheduled scan.Summary by CodeRabbit