docs(security): open the SECURITY.md monthly auto-update PR (CI can't create it) - #546
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughUpdated SECURITY.md to reflect new supported version patterns (current, limited, unsupported cutoff) and refreshed the "Last Updated" metadata to a newer date and version number. ChangesSecurity policy version update
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Opens the monthly auto-regenerated SECURITY.md update branch for review, keeping WFL’s published supported-version window and “Last Updated” footer in sync with the current release and the automation that generates it.
Changes:
- Update the supported-versions table to advance the support window to
26.6.x(current),26.5.x(limited), and26.4.x and older(unsupported). - Update the footer “Last Updated” month/year and the referenced WFL version.
- Add/modify the
scripts/update_security_doc.shautomation used by the scheduled workflow to regenerateSECURITY.md.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
SECURITY.md |
Advances supported-version tiers and updates the footer metadata (month/version). |
scripts/update_security_doc.sh |
Script used by automation to regenerate SECURITY.md from Cargo.toml version data. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| | 26.6.x (Current)| ✅ Yes | Active development, security fixes prioritized | | ||
| | 26.5.x | ⚠️ Limited | Critical security issues only | | ||
| | 26.4.x and older| ❌ No | No security updates provided | |
|
CI is fully green on this PR — 14 checks passed (Build/Test/Clippy, both Integration matrices, Database Tests, Run WFL Programs on ubuntu+windows, CodeQL, fmt, config-lint, CodeRabbit, claude-review), 2 expected skips (Bump Version, claude), zero failures. Reminder: this only lands the July regeneration. To stop Posted by the WFL repo warden (automated triage pass). |
What was broken
The scheduled Update SECURITY.md workflow (
update-security-doc.yml) has failed on the 1st of every month — most recently run 28485935619 on 2026-07-01, and identically on 06-01, 05-01, 04-01, 03-01, and 02-01. The regeneration script runs fine and the branch pushes successfully; the run dies at the final Create Pull Request step with:Root cause
This is a repository/organization setting, not a code bug. The org-level "Allow GitHub Actions to create and approve pull requests" toggle is off (
can_approve_pull_request_reviews: falseat both repo and org), so the built-inGITHUB_TOKENused bypeter-evans/create-pull-requestis blocked from opening the PR. The push half of the action succeeds, which is why an orphanedauto/update-security-doc-*branch is left behind each month.The fix (this PR)
The branch
auto/update-security-doc-1782867320that the 07-01 run pushed already contains the correct, docs-only regeneration. This PR simply opens it for review so the update isn't lost. The diff is exactly what the workflow intended:26.1.x→26.6.x(and limited/unsupported rows shifted accordingly).Last Updated: January 2026 / Version 26.1.35→July 2026 / Version 26.6.5.No source or behavior changes; nothing in
TestPrograms/is affected.Permanent fix (needs a maintainer — cannot be done from CI)
To stop the monthly failure, enable Settings → Actions → General → Workflow permissions → "Allow GitHub Actions to create and approve pull requests" (repo or org level). Alternatively, pass a PAT secret to the
create-pull-requeststep instead ofGITHUB_TOKEN. Until one of those is done, this workflow will keep failing on the 1st and I'll keep opening the PR by hand.Verification
Diff reviewed via the compare API: 1 commit,
SECURITY.md(+5/-5) plus a mode-only touch toscripts/update_security_doc.sh. Docs-only; no local build needed.Posted by the WFL repo warden (automated triage pass).
Summary by CodeRabbit