Governance: remediate html4tree Scorecard alerts and disabled security surfaces #693

Activity

1. seonghobae

   added this to naruon Platform Roadmapon Aug 1, 2026
2. github-project-automation

   moved this to Todo in naruon Platform Roadmapon Aug 1, 2026
3. seonghobae commented on Aug 1, 2026

   

   seonghobae

   on Aug 1, 2026

   ContributorAuthor

   More actions

   Source-managed remediation is now in ContextualWisdomLab/html4tree#331 (current head 33688e35b9b99dafff98065945be1f69c885ab7e).

   Implemented and locally verified:

   • Gradle and GitHub Actions Dependabot coverage targeting master
   • repository-local private-reporting entry point with the organization policy retained as the single source of truth
   • CI verification of the checked-in Gradle 5.1.1 wrapper JAR against the published SHA-256
   • distributionSha256Sum for the Gradle 5.1.1 binary distribution
   • JDK 11 full build/tests/JaCoCo, actionlint, YAML parsing, and checksum checks passed

   The issue remains open for the approval-bound repository settings (secret scanning / push protection surfaces) and for post-merge governance disposition of the intentionally checked-in, checksum-verified wrapper JAR alert.
4. seonghobae commented on Aug 14, 2026

   

   seonghobae

   on Aug 14, 2026 – with ChatGPT Codex Connector

   ContributorAuthor

   More actions

   2026-08-14 maintenance update:

   • ContextualWisdomLab/html4tree now has weekly Gradle and GitHub Actions Dependabot configuration on master.
   • SECURITY.md delegates supported-version and response policy to the organization source of truth and links directly to private vulnerability reporting.
   • The checked-in Gradle wrapper remains intentional and CI verifies its exact SHA-256 before execution.
   • All workflow actions in the repository-local CI path are pinned by full commit SHA.

   The remaining repository-setting decision is secret scanning/non-provider patterns/validity/push protection. The connected GitHub App receives 403 Resource not accessible by integration when reading code-scanning alerts and does not expose a settings mutation, so this issue must remain open until an administrator records and applies that decision, then reruns Scorecard/SARIF on the default branch. Do not close the issue solely from source-tree evidence.
5. opencode-agent

   added

   area: ci-cdCI, GitHub Actions, checks, release, or supply chainCI, GitHub Actions, checks, release, or supply chain

   area: dependenciesDependency or lockfile maintenanceDependency or lockfile maintenance

   area: operationsOperability, observability, readiness, SLO, backup, or retentionOperability, observability, readiness, SLO, backup, or retention

   area: securitySecurity boundary, hardening, or vulnerability preventionSecurity boundary, hardening, or vulnerability prevention

   priority: mediumNormal-priority or P2 workNormal-priority or P2 work

   status: triagedOpen issue has an organization taxonomy assignmentOpen issue has an organization taxonomy assignment

   type: featureNew or expanded product capabilityNew or expanded product capability

   on Aug 22, 2026
6. seonghobae commented on Aug 23, 2026

   

   seonghobae

   on Aug 23, 2026 – with ChatGPT Codex Connector

   ContributorAuthor

   More actions

   Fresh governance evidence — 2026-08-23

   ContextualWisdomLab/html4tree now has an independently reproduced release-control defect in addition to the Scorecard/security-surface items already tracked here. Live master@de82f99f66fc9e190398f9bb1c8c6bd69bd88a30 returns protected: true, but the effective protection payload is enabled=false, required-status-check enforcement is off, and both required context/check sets are empty.

   This is material on current buyer-facing PR #515 (969c35a9691b092e88897743464ff1444cf84126): exact-head CI, Security Scan and SAST Semgrep are terminal-success, but those jobs are not currently enforced by the branch setting and there is no qualifying independent approval. Two current Devin informational threads also remain unresolved. I did not merge or bypass anything.

   Repository-local issue creation is unavailable because html4tree Issues are disabled (GitHub returned HTTP 410), so this central issue is the appropriate owner for the setting defect.

   Required admin acceptance before any protected merge claim:

   • restore an actually enforced master branch protection/ruleset with PR-only integration;
   • require the exact-current-head repository CI/Security/SAST gates plus applicable organization-wide required contexts;
   • require qualifying independent non-author review, stale-approval invalidation and resolved review threads;
   • block force pushes/deletion and routine administrator bypass; and
   • fresh-read the live setting afterward and verify effective enforcement/non-empty required-gate semantics rather than relying on the protected: true badge.
7. seonghobae

   added

   bugSomething isn't workingSomething isn't working

   type: bugDefect or incorrect behaviorDefect or incorrect behavior

   on Sep 7, 2026