From 57e13227f4902026797ae941254a2585847c3cb5 Mon Sep 17 00:00:00 2001 From: "code-ranker-app[bot]" <296515340+code-ranker-app[bot]@users.noreply.github.com> Date: Sun, 28 Jun 2026 22:11:51 +0000 Subject: [PATCH 1/5] Add code-ranker report workflow --- .github/workflows/code-ranker.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .github/workflows/code-ranker.yml diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml new file mode 100644 index 0000000..1a57727 --- /dev/null +++ b/.github/workflows/code-ranker.yml @@ -0,0 +1,12 @@ +name: code-ranker +on: + pull_request: + push: +jobs: + code-ranker: + uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1 + permissions: + id-token: write + contents: read + pull-requests: write + security-events: write From 2fbbdd1eec05b75851e91d9354e27a77caa3e05d Mon Sep 17 00:00:00 2001 From: "code-ranker-app[bot]" <296515340+code-ranker-app[bot]@users.noreply.github.com> Date: Sat, 18 Jul 2026 20:50:08 +0000 Subject: [PATCH 2/5] Add code-ranker report workflow --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 1a57727..475d766 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@v1 permissions: id-token: write contents: read From ba404f77b629e0ebdfcc4f9a617aeef265cbde81 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 14:36:29 +0000 Subject: [PATCH 3/5] ci: pin code-ranker reusable workflow to immutable SHA Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 475d766..37586d1 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 permissions: id-token: write contents: read From 64bebf0ca52b053418ab762c76c775f6ffd8e16e Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:07:54 +0000 Subject: [PATCH 4/5] ci: bump code-ranker pin to v1 (advisory findings wording) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 37586d1..18274c2 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read From 99319b0477d156b486a7e0b9648a66946fe91c77 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:24:14 +0000 Subject: [PATCH 5/5] ci: normalize code-ranker stub (clean, least-privilege) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 18274c2..208db7b 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,9 +4,12 @@ on: push: jobs: code-ranker: + # Pinned to an immutable commit SHA (supply-chain hardening). uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read - pull-requests: write + # No pull-requests: write here — the code-ranker GitHub App posts (and + # updates in place) the report comment using its own installation + # token, not this workflow's GITHUB_TOKEN. security-events: write