From 869b8a97e8075d1d01aca7949aecf6425d79e49d Mon Sep 17 00:00:00 2001 From: "code-ranker-app[bot]" <296515340+code-ranker-app[bot]@users.noreply.github.com> Date: Sun, 28 Jun 2026 22:11:32 +0000 Subject: [PATCH 1/5] Add code-ranker report workflow --- .github/workflows/code-ranker.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .github/workflows/code-ranker.yml diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml new file mode 100644 index 0000000..1a57727 --- /dev/null +++ b/.github/workflows/code-ranker.yml @@ -0,0 +1,12 @@ +name: code-ranker +on: + pull_request: + push: +jobs: + code-ranker: + uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1 + permissions: + id-token: write + contents: read + pull-requests: write + security-events: write From 741d4333a78fc6531a3dd5e6025260a1132a6d5e Mon Sep 17 00:00:00 2001 From: "code-ranker-app[bot]" <296515340+code-ranker-app[bot]@users.noreply.github.com> Date: Sat, 18 Jul 2026 20:49:50 +0000 Subject: [PATCH 2/5] Add code-ranker report workflow --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 1a57727..475d766 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@v1 permissions: id-token: write contents: read From c939e06964d58c9fa69a7a3b499b18a07e339598 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 14:36:16 +0000 Subject: [PATCH 3/5] ci: pin code-ranker reusable workflow to immutable SHA Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 475d766..37586d1 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 permissions: id-token: write contents: read From a365cebb44151fc8da0e8eb2774067dbf21f4a95 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:07:43 +0000 Subject: [PATCH 4/5] ci: bump code-ranker pin to v1 (advisory findings wording) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 37586d1..18274c2 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read From 5a69839169accea5605d7a7caa6447557bb9c3fa Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:24:03 +0000 Subject: [PATCH 5/5] ci: normalize code-ranker stub (clean, least-privilege) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 18274c2..208db7b 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,9 +4,12 @@ on: push: jobs: code-ranker: + # Pinned to an immutable commit SHA (supply-chain hardening). uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read - pull-requests: write + # No pull-requests: write here — the code-ranker GitHub App posts (and + # updates in place) the report comment using its own installation + # token, not this workflow's GITHUB_TOKEN. security-events: write