Conversation
There was a problem hiding this comment.
Pull request overview
Security-hardening updates to the CLI and seed template GitHub Actions release pipelines by adding release gating, preventing overlapping release runs, and introducing OpenSSF Scorecard scanning.
Changes:
- Add
environment: releasegate and workflow-levelconcurrencyto the CLI release workflow. - Add workflow-level
concurrency, pin GoReleaser version, and add build provenance attestation to the seed release workflow. - Add OpenSSF Scorecard workflows for both CLI and seed template.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
seed/.github/workflows/scorecard.yml |
Adds an OpenSSF Scorecard workflow emitting SARIF to GitHub security tooling. |
seed/.github/workflows/release.yml |
Adds release concurrency, pins GoReleaser, and introduces provenance attestation + permissions. |
.github/workflows/scorecard.yml |
Adds an OpenSSF Scorecard workflow for the main repo. |
.github/workflows/release.yml |
Adds release concurrency and an environment: release gate on the publish job. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e894c18829
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Updates ai-labeler to use the fixed shared workflows that parse JSON responses correctly and include pull-requests:read for private repos.
Job-level permissions override workflow-level permissions. The attestation step runs in the release job which only had contents, id-token, and models, so the workflow-level attestations: write was ineffective.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Pin codeql-action/upload-sarif to the same SHA used in security.yml and add continue-on-error for graceful degradation when Advanced Security isn't available.
Summary
environment: releasegate to thepublishjob in the cli release workflowconcurrencyguard to both cli and seed release workflows to prevent parallel releasesv2.14.1)attestations: writepermission and build provenance attestation step to seed release${{ }}expressions inenv:blocks (no changes needed)Test plan
release.ymlhasenvironment: releaseon publish job