Enable Dependabot, CodeQL and secret scanning
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 10
- Forks
- 0
- Avg merge
- 2h 52m
- Merged PRs (30d)
- 20
Description
Tier 3 — supply chain
Problem
.github/ contains no dependabot.yml and no code-scanning workflow. NuGet dependencies (including a preview .NET 10 SDK, MudBlazor and HtmlAgilityPack — the latter parsing untrusted third-party HTML) are updated only by hand, and nothing scans for vulnerable packages, code-level issues or committed secrets.
Evidence
.github/contains onlyworkflows/azure-app-service.yml, docs, agents, prompts and skills
Proposed fix
.github/dependabot.ymlfornugetandgithub-actions, weekly.- CodeQL analysis workflow for C#.
- Enable secret scanning and push protection in repository settings.
- Add
dotnet list package --vulnerable --include-transitiveto CI.
Acceptance criteria
- Dependabot opens update PRs
- CodeQL runs on PRs to
main - Vulnerable packages fail the build
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the existing .github/workflows/azure-app-service.yml and the repository's .github contents first. Add the proposed Dependabot configuration, CodeQL workflow, CI vulnerability check, and repository security settings, then verify that CodeQL runs for pull requests to main and vulnerable packages fail the build.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, github-actions
- Domain
- ci-cd, devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100