Take the HOL scanner from 83 to 100 - #1
Merged
Merged
Conversation
The centralized HOL scan flagged five findings, all of them missing paperwork rather than code: - no SECURITY.md, so there was no way to report a vulnerability privately - no Dependabot config, though npm and Actions surfaces exist - the nested Claude plugin manifest had no "version", which the Claude manifest requires, and no license - the nested plugin directory shipped neither LICENSE nor SECURITY.md This adds all of them, plus the scanner workflow from SCANNER_GUIDE.md with both actions pinned to commit SHAs, so the source repo scans itself on every push and pull request. plugin-scanner lint . now reports 100/100 with zero findings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The scanner version the HOL action pins, 3.0.123, wants a boolean "strict" in .claude-plugin/marketplace.json and scores its absence as a medium finding. The newer 3.0.192 no longer checks it, which is why a local scan read 100 while CI read 97. Pinned scanner now agrees: 100/100, no findings. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The security policy inaccurately describes token, process, and filesystem behavior.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
What changed in this PR
Adds the missing security, licensing, dependency, metadata, and scanner CI paperwork needed to raise the HOL scanner score.
Changes:
- Adds root and nested security policies plus plugin licensing.
- Adds plugin version/license metadata.
- Adds pinned scanner workflow and weekly Dependabot updates.
| File | Description |
|---|---|
SECURITY.md |
Root vulnerability policy |
plugin/SECURITY.md |
Plugin security policy link |
plugin/LICENSE |
Plugin GPL-2.0 license |
plugin/.claude-plugin/plugin.json |
Version and license metadata |
.github/workflows/scan.yml |
Pinned security scan CI |
.github/dependabot.yml |
Weekly dependency updates |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
|
||
| ## What Kitbash Touches | ||
|
|
||
| The MCP server makes unauthenticated `GET` requests to `api.github.com` to confirm that the repositories it names exist. It reads no files, writes no files outside the ones you ask an agent to write, and runs no shell commands. `GITHUB_TOKEN`, if set, is sent only to `api.github.com` to raise the rate limit. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested on hashgraph-online/awesome-ai-plugins#385: the centralized HOL scan came in at 79/100, below the 80 merge threshold.
plugin-scanner lint .reproduced it locally at 83 with five findings, all missing paperwork rather than code:SECURITY_MD_MISSINGSECURITY.md— private reporting via GitHub Security Advisories, supported versions, and what the server touchesDEPENDABOT_MISSING.github/dependabot.yml— weekly npm and github-actions updatesCLAUDE_FIELD_MISSING_VERSION"version": "0.1.0"inplugin/.claude-plugin/plugin.json, matchingpackage.jsonLICENSE_MISSING(nested)plugin/LICENSE— copy of the repo's GPL-2.0, plus"license": "GPL-2.0-only"in the manifestSECURITY_MD_MISSING(nested)plugin/SECURITY.mdpointing at the root policyAlso adds
.github/workflows/scan.yml, the workflow from the current SCANNER_GUIDE.md verbatim:contents: readonly, no secrets,persist-credentials: false,min_score: 80, and both actions pinned to commit SHAs (actions/checkout@11bd719v4.2.2,hashgraph-online/ai-plugin-scanner-action@caba2e9v1.2.635).After the fixes, the same scanner reports:
🤖 Generated with Claude Code
Summary by CodeRabbit
Security
Maintenance
Documentation