Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Tracker: security and board automation on a GitHub App credential

Đang mở
  • Có gì không ổn?
#2,543 2 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
25/100
Loại issue
Tính năng
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
github, github-actions
Lĩnh vực
ci-cd, devops, security, tooling

Hướng nghiên cứu

Start with the Sub-issues panel and AGENTS.md, separating the unblocked CodeQL and alerts #74–#76 from the GitHub App prerequisite. Then inspect sdk-watch.yml and the credentialed automation work listed in the sub-issues, preserving the stated job, marker, pinning, failure, and human-gating invariants. Done means every sub-issue is closed and a nightly run boards what it files without manual intervention.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

chore v2

Goal

Put the repo's security and board automation on one GitHub App credential, so alerts, advisories and new issues reach board #28 without a maintainer running /issue-triage by hand, and so v2 code is scanned before the release PR rather than on it.

Why now

The v2.9.0 release showed every gap at once:

  • CodeQL never scans v2/main. A high-severity ReDoS introduced this milestone (#2540) surfaced only on the milestone-merge PR, and held the release.
  • Code-scanning alerts become no issues at all. Three high-severity alerts (#74–#76) are open and untracked.
  • The Dependabot sweep files issues it cannot board, because the PROJECT_TOKEN it reads has never existed. The SDK watch and the monthly refresh never board by design, for the same reason.
  • GHSA draft cards and nightly triage were both parked as blocked on the same credential, with no card of their own for the credential.

Structure

Everything that writes to the board waits on one prerequisite: the GitHub App. Two items need no credential and can start immediately.

The Sub-issues panel on this issue is the canonical list, in this order:

  1. #2544, the GitHub App. The long pole and human-gated (org admin), so it goes first and is requested now. Take every other admin decision to the same conversation (see below).
  2. #2545, CodeQL on v2/main. Needs no credential; runs in parallel with #2544. Disabling default setup is a repo-admin act.
  3. #2547, the Dependabot sweep onto the App. The smallest consumer and the end-to-end proof that the App works; it sets the token-step pattern the rest copy.
  4. #2462, GHSA draft cards. Its docs half (skills, AGENTS.md) needs no credential and can start before #2544 lands.
  5. #2548, boarding for the SDK watch and monthly refresh. Reuses #2547's pattern.
  6. #2542, the code-scanning sweep. Better after #2545, so alerts exist on the v2/main ref instead of a file/line re-check.
  7. #2463, nightly triage. The largest, and it needs a second credential decision (federation or a capped model key for third-party input).

#2546 (alerts #74–#76) is done.

Admin decisions to take in one pass
  • Create and install the App with #2544's permission list (and decide on the optional Administration: read).
  • Disable CodeQL default setup when #2545's workflow lands.
  • Whether secret scanning is in #2542's scope (adds a read permission to the App).
  • #2463's model credential: workload identity federation, or a dedicated CI-scoped key with a spend cap.

Invariants every sub-issue keeps

These are from AGENTS.md:

  • No model runs in a write-capable job. The deterministic sweeps need no model. Nightly triage (#2463) does, and must use the three-job shape sdk-watch.yml established.
  • A marker is trusted only on automation-authored issues, because the repo is public.
  • Every action in a credentialed job is SHA-pinned (verify:action-pins).
  • A sweep that cannot read its listing fails loudly and writes nothing.
  • Accepting and publishing a security advisory stay human-gated; automation only creates tracking cards.

Done when

Every sub-issue is closed, and a nightly run boards what it files with no manual step.

Ngôn ngữ chính
TypeScript
Star
11.1k
Fork
1.6k
Merge trung bình
5 giờ 38 phút
Pull request đã merge (30 ngày)
152

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của modelcontextprotocol/inspector

Tất cả issue của modelcontextprotocol/inspector

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.