chore: baseline maturity level 1 - #10
Conversation
Signed-off-by: PaarthPandey10 <paarthdxb@gmail.com>
There was a problem hiding this comment.
Pull request overview
Adds the Baseline Maturity Level 1 configuration artifacts to the gemaraproj/website repository, aligning the repo’s security posture and baseline-scanning automation with the primary gemaraproj/gemara project (per Issue #5).
Changes:
- Added
security-insights.ymlwith repository metadata and security tooling/integration details. - Added a scheduled + manually-triggerable OSPS baseline scanning workflow that uploads SARIF and stores scan artifacts.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| security-insights.yml | Introduces the Security Insights metadata/configuration for this repository. |
| .github/workflows/baseline-scanner.yml | Adds a scheduled/manual OSPS baseline scanning workflow with SARIF upload and artifact retention. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Signed-off-by: PaarthPandey10 <paarthdxb@gmail.com>
hbraswelrh
left a comment
hbraswelrh
left a comment
There was a problem hiding this comment.
LGTM. Left one question regarding the osps-baseline-action version.
| permission-administration: read | ||
|
|
||
| - name: Run Baseline Action | ||
| uses: revanite-io/osps-baseline-action@b7d860b68755627c30ab692473511c90daee3ae8 # v1.3.4 |
There was a problem hiding this comment.
@jpower432 @PaarthPandey10 should we be using the OSPS Baseline Action v1.5.0?
There was a problem hiding this comment.
Thanks @hbraswelrh. I am going to merge this as is. We need a dependabot.yml in place to make sure all dependencies get bumped.
There was a problem hiding this comment.
@hbraswelrh Scratch that. I see that you requested changes which is blocking the PR. Was this meant to be non-blocking?
There was a problem hiding this comment.
Just to clarify before I push another update—do we absolutely need to bump to v1.5.0 right now to unblock this PR, or are we good to merge v1.3.4 and let a future dependabot.yml handle it as Jenn mentioned?
If v1.5.0 is strictly required to clear the blocking review, I can easily knock that out by EOD today (Thursday).
There was a problem hiding this comment.
Hi @PaarthPandey10, based on the comment from @jpower432 I will approve your PR and follow-up with a dependabot trigger to update our dependencies. No changes needed on your end and v1.3.4 is good for now. Thanks for the awesome work.
This Pull Request introduces the necessary configurations to ensure the website repository meets Baseline Maturity Level 1 requirements, aligning its security posture with the primary gemara project.
Changes Included:
Added a security-insights.yml file tailored specifically for the gemaraproj/website routing and documentation structure.
Added an OSPS Baseline Scanner CI workflow (.github/workflows/baseline-scanner.yml) configured to run automatically on a weekly schedule (Mondays at 9 AM UTC) and on manual dispatch.
Resolves #5