Skip to content

Conversation

@justaugustus
Copy link
Member

@justaugustus justaugustus commented Nov 25, 2025

What kind of change does this PR introduce?

(Is it a bug fix, feature, docs update, something else?)

Follow-up to #4862, as the OSPS Baseline assessment GitHub Action uses security-insights.yml as input.

  • .github: Add security-insights.yml
  • MAINTAINERS: Update Jeff's affiliation

What is the current behavior?

What is the new behavior (if this is a feature change)?**

  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Special notes for your reviewer

Note that this is an intentionally minimally viable security-insights.yml. We'll add on top of the MVP post-merge.

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

NONE

@justaugustus justaugustus requested a review from a team as a code owner November 25, 2025 02:46
@justaugustus justaugustus requested review from AdamKorcz and raghavkaul and removed request for a team November 25, 2025 02:46
@dosubot dosubot bot added the size:M This PR changes 30-99 lines, ignoring generated files. label Nov 25, 2025
@codecov
Copy link

codecov bot commented Nov 25, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.59%. Comparing base (353ed60) to head (a6f2f21).
⚠️ Report is 285 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4863      +/-   ##
==========================================
+ Coverage   66.80%   69.59%   +2.78%     
==========================================
  Files         230      251      +21     
  Lines       16602    15657     -945     
==========================================
- Hits        11091    10896     -195     
+ Misses       4808     3891     -917     
- Partials      703      870     +167     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Member

@spencerschrock spencerschrock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a few nits

Signed-off-by: Stephen Augustus <foo@auggie.dev>
Some security analysis tools leverage security-insights.yml to infer
information about a project, so we add it here.

Signed-off-by: Stephen Augustus <foo@auggie.dev>
@justaugustus justaugustus enabled auto-merge (squash) November 25, 2025 16:05
@justaugustus justaugustus merged commit 488797d into ossf:main Nov 25, 2025
37 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:M This PR changes 30-99 lines, ignoring generated files.

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

2 participants