This repository contains shared GitHub Actions workflows and composite actions used across multiple OpenNews production websites. Security vulnerabilities here can affect all consuming repositories.

In scope:

• Vulnerabilities in workflow logic or action definitions
• Insecure permissions or credential handling
• Dependency vulnerabilities in consumed actions
• Supply chain security issues

Out of scope:

• Vulnerabilities in consuming repositories (report to those repos directly)
• General GitHub Actions platform issues (report to GitHub)

Every merge to main automatically creates a new patch release and updates the floating @v1 tag. Sites referencing @v1 receive the update immediately with no manual intervention.

• All changes must go through a pull request — direct pushes to main are blocked
• PR review required — especially for Dependabot updates; check release notes for breaking changes
• Test against a consuming repo before merging:

  # Temporarily point at your branch
  uses: OpenNews/opennews-actions/jekyll-build@your-branch-name

  Run manually from Actions tab, confirm it works, then revert
• Breaking changes require a new major version (e.g., v2) — coordinate with team before releasing

• Merging to main → auto-publishes patch release (e.g., v1.0.2 → v1.0.3)
• Release notes generated from PR titles
• Floating v1 tag force-updated to latest patch
• For major versions, manually create and push the tag

We support only the latest release. Breaking changes require a new major version (e.g., v2). Security fixes are always released as patch updates and automatically deployed via the floating major version tag (v1 → v1.0.x).

Do not open public issues for security vulnerabilities.

1. Go to the Security Advisories page
2. Click "Report a vulnerability"
3. Fill out the advisory form with details

Send details to info@opennews.org with:

• Description of the vulnerability
• Steps to reproduce or proof of concept
• Potential impact (which consuming repos are affected)
• Suggested fix (optional)

• We'll acknowledge your report and assess severity
• We may ask for additional information
• We'll develop and test a fix
• We'll release a patch and update the security advisory
• We'll credit you in the advisory (unless you prefer to remain anonymous)

When contributing to this repository:

• Use trusted third-party actions only, and pin them to approved major versions
• Use minimal required permissions in workflows
• Never log or expose secrets
• Use actions/checkout@v6 or later (includes security fixes)
• Enable Dependabot security updates
• Review dependency updates for breaking changes before merging

We follow coordinated disclosure principles. We ask that security researchers:

• Allow reasonable time for patching before public disclosure
• Avoid exploiting vulnerabilities beyond proof of concept
• Do not access or modify user data in consuming repositories
• Act in good faith to help improve security

Thank you for helping keep OpenNews projects secure.