From 74415b636bbbe4a0507f8b8a9316307a00f9a2dc Mon Sep 17 00:00:00 2001 From: "code-ranker-app[bot]" <296515340+code-ranker-app[bot]@users.noreply.github.com> Date: Sun, 28 Jun 2026 22:11:35 +0000 Subject: [PATCH 1/6] Add code-ranker report workflow --- .github/workflows/code-ranker.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .github/workflows/code-ranker.yml diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml new file mode 100644 index 0000000..1a57727 --- /dev/null +++ b/.github/workflows/code-ranker.yml @@ -0,0 +1,12 @@ +name: code-ranker +on: + pull_request: + push: +jobs: + code-ranker: + uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1 + permissions: + id-token: write + contents: read + pull-requests: write + security-events: write From 48701d38e93fbdcd09b397bff54a1a18ff8a8a51 Mon Sep 17 00:00:00 2001 From: "code-ranker-app[bot]" <296515340+code-ranker-app[bot]@users.noreply.github.com> Date: Sat, 18 Jul 2026 20:49:53 +0000 Subject: [PATCH 2/6] Add code-ranker report workflow --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 1a57727..475d766 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@v1 permissions: id-token: write contents: read From 0f6811eb9a530de6f5b96e79b2c211653f35b4cd Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 14:36:18 +0000 Subject: [PATCH 3/6] ci: pin code-ranker reusable workflow to immutable SHA Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 475d766..37586d1 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 permissions: id-token: write contents: read From abe00d39c0d578fd13fb3159bbc0babed01070cc Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:03:11 +0000 Subject: [PATCH 4/6] ci: bump code-ranker pin to v1 (advisory findings wording) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 37586d1..102110c 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@485febd51d1cf0f666e262de6e37e1d2e3f6d7f5 # v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c # v1 permissions: id-token: write contents: read From 0067718b7cbbb10476b69b957ef3941f5e92c925 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:07:45 +0000 Subject: [PATCH 5/6] ci: bump code-ranker pin to v1 (advisory findings wording) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 102110c..18274c2 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,7 +4,7 @@ on: push: jobs: code-ranker: - uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c # v1 + uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read From f43a72bf9702b9bf301788b1f6949ed9f42dcdf3 Mon Sep 17 00:00:00 2001 From: Roman Fedorov Date: Thu, 23 Jul 2026 15:24:05 +0000 Subject: [PATCH 6/6] ci: normalize code-ranker stub (clean, least-privilege) Signed-off-by: Roman Fedorov --- .github/workflows/code-ranker.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml index 18274c2..208db7b 100644 --- a/.github/workflows/code-ranker.yml +++ b/.github/workflows/code-ranker.yml @@ -4,9 +4,12 @@ on: push: jobs: code-ranker: + # Pinned to an immutable commit SHA (supply-chain hardening). uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c permissions: id-token: write contents: read - pull-requests: write + # No pull-requests: write here — the code-ranker GitHub App posts (and + # updates in place) the report comment using its own installation + # token, not this workflow's GITHUB_TOKEN. security-events: write