Skip to content
Permalink

Comparing changes

Choose two branches to see what鈥檚 changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: wp-cli/.github
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: wp-cli/.github
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: claude/wp-cli-github-security-audit-m0tl72
Choose a head ref
Checking mergeability… Don鈥檛 worry, you can still create the pull request.
  • 1 commit
  • 6 files changed
  • 1 contributor

Commits on Aug 7, 2026

  1. Harden CI supply chain and add an org-wide security policy 

    Addresses findings from a security review of this repository. These workflows
are consumed by ~45 repositories in the organization, so changes here apply
org-wide.

Add SECURITY.md
  This repository provides the organization's default community health files,
  but had no security policy, so no wp-cli repository surfaced a "Report a
  vulnerability" path. Points at the WP-CLI handbook and the WordPress
  HackerOne program rather than restating policy that lives elsewhere.

Scope `actions: write` to the job that needs it
  It was declared at workflow level, so it also reached `triage-new-item`,
  which runs on `pull_request_target` and processes pull request titles and
  bodies written by anyone who can open a PR. `actions: write` permits
  dispatching workflows and deleting caches and artifacts, a known
  lateral-movement path. Only `triage-unlabeled-items` needs it, and that job
  is `workflow_dispatch`-only.

  The grant has to stay in the caller, since a caller can only cap a reusable
  workflow's permissions and never raise them; removing it there is what broke
  dispatching in #271 and prompted the revert in #272. Comments in both files
  record this so the next attempt narrows rather than removes.

Pin the two unpinned CI dependencies
  `docker://rhysd/actionlint:latest` is built from upstream `main`, not from a
  release: its digest differs from the 1.7.9 tag. Pinned by digest instead.
  Dependabot does not track `docker://` references, so this needs manual bumps.

  `npx --yes gherkin-lint` resolved and executed the newest publish on every
  run. The package was last released in December 2023 and has two maintainers,
  so a single account compromise would reach CI in every repository. Pinned to
  4.2.4.

Correct the actions/setup-node pin comment
  The pinned SHA is v7.0.0, but the trailing comment read v6. The pin itself is
  immutable and current; the comment is what reviewers read, so a wrong one
  quietly defeats the point of the convention.

Fail the WP-CLI download loudly
  `curl -O` without `-f` writes the error body to the file and still exits 0,
  so an outage installed an HTML page as /usr/local/bin/wp and surfaced as a
  confusing failure much later.

Reduce blast radius of the workflow sync
  SKIP_DELETE stops a pattern change from deleting files across every target
  repository. The FILE_PATTERNS regexes now escape their dots so they match
  only the intended paths. Both jobs drop to `contents: read`, since the sync
  authenticates with ACTIONS_BOT and never uses GITHUB_TOKEN to write. The
  schedule drops from every ten minutes to hourly; pushes to the default
  branch still sync immediately.
    @claude
    claude committed Aug 7, 2026
    Configuration menu
    Copy the full SHA
    2b6e4cd View commit details
    Browse the repository at this point in the history
Loading