From 615e97c8e157dd0ff41e5b8736769a7a6abb8d49 Mon Sep 17 00:00:00 2001 From: Sami Ahmed Siddiqui Date: Mon, 19 Oct 2026 18:15:27 +0500 Subject: [PATCH] Add security policy, Dependabot, CodeQL and contributor docs - SECURITY.md: report vulnerabilities through private GitHub advisories - Dependabot: weekly npm and GitHub Actions updates, grouped - CodeQL code scanning on pushes, pull requests and weekly - CI and CodeQL workflows get a read-only token - CODEOWNERS, CONTRIBUTING.md, pull request and issue templates --- .github/CODEOWNERS | 1 + .github/ISSUE_TEMPLATE/bug_report.yml | 31 ++++++++++++++++++++++ .github/ISSUE_TEMPLATE/config.yml | 5 ++++ .github/ISSUE_TEMPLATE/feature_request.yml | 15 +++++++++++ .github/dependabot.yml | 16 +++++++++++ .github/pull_request_template.md | 10 +++++++ .github/workflows/ci.yml | 3 +++ .github/workflows/codeql.yml | 24 +++++++++++++++++ CONTRIBUTING.md | 28 +++++++++++++++++++ SECURITY.md | 23 ++++++++++++++++ 10 files changed, 156 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml create mode 100644 .github/dependabot.yml create mode 100644 .github/pull_request_template.md create mode 100644 .github/workflows/codeql.yml create mode 100644 CONTRIBUTING.md create mode 100644 SECURITY.md diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..7d55496 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @samiahmedsiddiqui diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..09f6e9c --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,31 @@ +name: Bug report +description: Something doesn't work as documented +labels: [bug] +body: + - type: textarea + id: what + attributes: + label: What happened? + description: What did you expect instead? + validations: + required: true + - type: textarea + id: reproduce + attributes: + label: How to reproduce + description: The command or code you ran, and a public URL that shows the problem if you can share one. + render: shell + validations: + required: true + - type: input + id: version + attributes: + label: check-http-status version + placeholder: "2.2.0" + validations: + required: true + - type: input + id: node + attributes: + label: Node.js version and OS + placeholder: "Node 22, macOS 15" diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..aaa238f --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: true +contact_links: + - name: Report a security vulnerability + url: https://github.com/trunkcode/check-http-status/security/advisories/new + about: Please report security problems privately, not as a public issue. diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..0a51ae0 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,15 @@ +name: Feature request +description: Suggest an idea or improvement +labels: [enhancement] +body: + - type: textarea + id: problem + attributes: + label: What are you trying to do? + description: The problem or use case, not just the solution. + validations: + required: true + - type: textarea + id: solution + attributes: + label: How could it work? diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..77a2b94 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +version: 2 +updates: + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + groups: + dev-dependencies: + dependency-type: development + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + actions: + patterns: ["*"] diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..5a12144 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,10 @@ +## What and why + + + +## Checklist + +- [ ] `npm run lint`, `npm run test:types` and `npm test` pass +- [ ] Tests added or updated for the change +- [ ] README, types (`index.d.ts`) and `schema.json` updated if options or results changed +- [ ] `CHANGELOG.md` updated diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2c24a8c..964b69b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,9 @@ on: branches: [main, v2] pull_request: +permissions: + contents: read + jobs: test: strategy: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..df93de9 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,24 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + schedule: + - cron: '23 4 * * 1' + +permissions: + contents: read + +jobs: + analyze: + name: Analyze (javascript-typescript) + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - uses: actions/checkout@v4 + - uses: github/codeql-action/init@v4 + with: + languages: javascript-typescript + - uses: github/codeql-action/analyze@v4 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..6a4d9d4 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,28 @@ +# Contributing + +Thanks for helping out! Bug reports, ideas and pull requests are all welcome. + +## Development + +```bash +npm install +npm run lint +npm run test:types +npm test +``` + +Tests run against a small fake website in `test/fixtures/site.js`, so they don't need +the network. Add a page there when a new feature needs one. + +## Pull requests + +- Keep each pull request to one change, and add or update tests for it. +- Update the README, `index.d.ts` and `schema.json` when options or results change, + and add a line to `CHANGELOG.md`. +- CI runs lint, type checks and tests on Linux, macOS and Windows with Node 20, 22 + and 24; all of them must pass before merging. +- Commits to `main` must be signed. + +## Security + +Please report vulnerabilities privately; see [SECURITY.md](SECURITY.md). diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..ac50b0f --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,23 @@ +# Security policy + +## Supported versions + +Security fixes are released for the latest 2.x version. Please upgrade before +reporting a problem in an older version. + +## Reporting a vulnerability + +Please **don't open a public issue**. Report it privately through +[GitHub security advisories](https://github.com/trunkcode/check-http-status/security/advisories/new) +instead. + +Include the version, how to reproduce the problem and what an attacker could do with +it. You'll get a reply within a week. Once a fix is released, the advisory is +published and you're credited unless you'd rather not be. + +## Scope + +check-http-status sends requests to the URLs you give it and to the links it finds +on those pages. Things worth reporting include credentials (HTTP Basic auth, cloud +upload tokens) being sent to the wrong host, and crawled content being able to run +script in the HTML report.