From f456198749f278ccb0272523c8459475ec066ed0 Mon Sep 17 00:00:00 2001 From: "code-ranker-app[bot]" <296515340+code-ranker-app[bot]@users.noreply.github.com> Date: Sun, 28 Jun 2026 22:11:26 +0000 Subject: [PATCH 1/5] Add code-ranker report workflow --- .github/workflows/code-ranker.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .github/workflows/code-ranker.yml diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml new file mode 100644 index 0000000..1a57727 --- /dev/null +++ b/.github/workflows/code-ranker.yml @@ -0,0 +1,12 @@ +name: code-ranker +on: + pull_request: + push: +jobs: + code-ranker: + uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1 + permissions: + id-token: write + contents: read + pull-requests: write + security-events: write From 31941f904c50d5434b9217234e5d6f8bc6cd17fe Mon Sep 17 00:00:00 2001 From: "code-ranker-app[bot]" <296515340+code-ranker-app[bot]@users.noreply.github.com> Date: Sat, 18 Jul 2026 20:49:47 +0000 Subject: [PATCH 2/5] Add code-ranker report workflow --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 1a57727..475d766 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@v1 permissions: id-token: write contents: read From 04bb115cb2245da4aeb05fb95fdd07700c6e9172 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 14:36:13 +0000 Subject: [PATCH 3/5] ci: pin code-ranker reusable workflow to immutable SHA Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 475d766..37586d1 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 permissions: id-token: write contents: read From 2a52d146c10a9f9955315e555b72ee9202cc5a8f Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:07:38 +0000 Subject: [PATCH 4/5] ci: bump code-ranker pin to v1 (advisory findings wording) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 37586d1..18274c2 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read From 587f8fd58a39e85911ed4ad6b8a3a7f1046619e4 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:23:59 +0000 Subject: [PATCH 5/5] ci: normalize code-ranker stub (clean, least-privilege) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 18274c2..208db7b 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,9 +4,12 @@ on: push: jobs: code-ranker: + # Pinned to an immutable commit SHA (supply-chain hardening). uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read - pull-requests: write + # No pull-requests: write here — the code-ranker GitHub App posts (and + # updates in place) the report comment using its own installation + # token, not this workflow's GITHUB_TOKEN. security-events: write