From c270fba1ab41b7db5582e88dfba471b5604ab0d7 Mon Sep 17 00:00:00 2001 From: Sebastien Taggart Date: Sun, 12 Apr 2026 13:12:26 -0400 Subject: [PATCH] Add SECURITY.md, fix workflow permissions, and redesign README header Add a lightweight security policy, restrict GITHUB_TOKEN permissions to contents:read in both CI workflows to resolve CodeQL warnings, and restructure the README with a centered header/tagline/badge layout. --- .github/workflows/sync-check.yml | 2 ++ .github/workflows/test.yml | 2 ++ README.md | 29 ++++++++++++++++++++++------- SECURITY.md | 24 ++++++++++++++++++++++++ 4 files changed, 50 insertions(+), 7 deletions(-) create mode 100644 SECURITY.md diff --git a/.github/workflows/sync-check.yml b/.github/workflows/sync-check.yml index 9eebc17..cdfe9a4 100644 --- a/.github/workflows/sync-check.yml +++ b/.github/workflows/sync-check.yml @@ -1,5 +1,7 @@ name: Sync check on: [push, pull_request] +permissions: + contents: read jobs: sync-check: runs-on: ubuntu-latest diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 63174e3..fc33538 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,5 +1,7 @@ name: Tests on: [push, pull_request] +permissions: + contents: read jobs: test: runs-on: ubuntu-latest diff --git a/README.md b/README.md index d1009bb..04647e1 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,25 @@ -![Code Cannon](.github/assets/readme-header.png) - -[![CI](https://github.com/LightbridgeLab/CodeCannon/actions/workflows/sync-check.yml/badge.svg)](https://github.com/LightbridgeLab/CodeCannon/actions/workflows/sync-check.yml) [![Tests](https://github.com/LightbridgeLab/CodeCannon/actions/workflows/test.yml/badge.svg)](https://github.com/LightbridgeLab/CodeCannon/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/LightbridgeLab/CodeCannon/branch/main/graph/badge.svg)](https://codecov.io/gh/LightbridgeLab/CodeCannon) [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) [![GitHub release](https://img.shields.io/github/v/release/LightbridgeLab/CodeCannon)](https://github.com/LightbridgeLab/CodeCannon/releases) [![Last Commit](https://img.shields.io/github/last-commit/LightbridgeLab/CodeCannon)](https://github.com/LightbridgeLab/CodeCannon/commits) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](docs/contributing.md) [![Python](https://img.shields.io/badge/Python-3.x-blue?logo=python&logoColor=white)](sync.py) [![Install](https://img.shields.io/badge/install-git%20submodule-blue?logo=git&logoColor=white)](https://github.com/LightbridgeLab/CodeCannon#quick-start) - -# Code Cannon - -Write your team's AI agent workflow once — start, submit-for-review, review, deploy — and sync it to Claude Code, Cursor, Gemini, and Codex across all your projects. +

Code Cannon

+

+ Write your AI agent workflow once. Sync it everywhere. +

+

+ Portable skills for Claude Code, Cursor, Gemini, and Codex — start, review, deploy — across all your projects. +

+

+ CI + Tests + codecov + License: MIT + GitHub release + Last Commit + PRs Welcome + Python + Install +

+ +

+ Code Cannon +

## The problem diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..859045e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,24 @@ +# Security Policy + +## Supported Versions + +| Version | Supported | +|---------|--------------------| +| Latest | :white_check_mark: | +| Older | :x: | + +Only the latest release receives security fixes. We recommend always using the most recent version. + +## Reporting a Vulnerability + +Code Cannon is a developer tool that generates static configuration files. It does not run a server, handle user credentials, or process sensitive data. The attack surface is limited to the sync script and generated output. + +If you discover a security issue, please **open a GitHub Issue** in this repository with the label `security`. Include: + +- A description of the vulnerability +- Steps to reproduce +- The potential impact + +We will acknowledge the report within 7 days and aim to provide a fix or mitigation within 30 days, depending on severity. + +For issues that could enable supply-chain attacks (e.g., generating malicious output files), please email the maintainers directly rather than opening a public issue. Contact information is available in the repository's GitHub profile.