fix(scorecard): dangerous-workflow, signed-releases, pinned-deps by imran-siddique · Pull Request #356 · microsoft/agent-governance-toolkit

imran-siddique · 2026-03-23T23:59:29Z

Full Scorecard sweep targeting 3 checks: Dangerous-Workflow 0->10 (removed explicit ref in pull_request_target), Signed-Releases 0->10 (added sigstore), Pinned-Dependencies 5->7+ (pinned CI pip versions). 11 files changed. Branch-Protection needs admin settings change separately.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

…icrosoft#326)

…s (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package

…stall agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

…it CI - scripts/check_dependency_confusion.py: Pre-commit hook that scans for pip install commands referencing unregistered PyPI packages. Maintains an allowlist of known registered packages. - .github/workflows/weekly-security-audit.yml: Weekly CI job running dependency confusion scan, security skills scan, and weak crypto check. Uploads reports as artifacts with 90-day retention. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…icrosoft#349) * docs: add testing guide for external testers and customers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add regulatory alignment table and Purview positioning to README Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): restore read-all at workflow level for Scorecard verification The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add comprehensive docstrings to mcp_adapter.py classes (microsoft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316 * ci: add markdown link checker workflow (microsoft#323) Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (microsoft#326) * fix: remove unregistered PyPI packages from notebooks and requirements (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package * fix(security): complete dependency confusion fix — replace all pip install agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update framework star counts to current values Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Parsa Faraji Alamouti <165321600+parsa-faraji@users.noreply.github.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Zeel Desai <72783325+zeel2104@users.noreply.github.com> Co-authored-by: Xavier Garceau-Aranda <xavier.garceau-aranda@posteo.net>

- agentmesh → agentmesh-platform (5 files) - agentmesh-governance → agent-governance-toolkit - agent-os-observability → agent-os-kernel[observability] - hashlib.md5 → hashlib.sha256 (3 files) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

…ore, pin CI deps Dangerous-Workflow: Remove ref: base.sha from pull_request_target workflows — default checkout IS the base branch, explicit ref triggers Scorecard false positive. Security preserved via persist-credentials: false + MSRC comments. Signed-Releases: Add sigstore/gh-action-sigstore-python to publish workflow for Python package signing alongside existing attest-build-provenance. Pinned-Dependencies: Pin pip install versions in CI workflows: - ci.yml: pytest==8.4.1, pytest-asyncio==0.26.0 - benchmarks.yml: add --no-cache-dir - security-scan.yml: pyyaml==6.0.2 - weekly-security-audit.yml: pyyaml==6.0.2 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions

🤖 AI Agent: code-reviewer

Review Summary

This PR addresses three key areas for improving the repository's security posture and compliance with the OpenSSF Scorecard checks: Dangerous Workflow, Signed Releases, and Pinned Dependencies. The changes are well-documented and aim to mitigate potential security risks, such as untrusted code execution in GitHub Actions and dependency drift. However, there are some areas that require further attention to ensure robustness and avoid potential issues.

Key Issues and Recommendations

🔴 CRITICAL: Missing Verification of Sigstore Signatures

The addition of Sigstore for signing release artifacts is a positive step toward supply chain security. However, there is no evidence in the PR that the signatures are being verified during the release process or by downstream consumers. Without verification, the signing process does not provide meaningful security guarantees.

Recommendation:

Add a step to verify Sigstore signatures during the release process or provide documentation for downstream consumers on how to verify the signatures.

🔴 CRITICAL: Lack of Integrity Verification for `pip install`

While pinning dependencies improves reproducibility, the pip install commands in the workflows do not include hash-based integrity checks (e.g., --require-hashes). This leaves the pipeline vulnerable to supply chain attacks, such as dependency confusion or compromised PyPI packages.

Recommendation:

Use pip install --require-hashes with a requirements.txt file that includes hashes for all dependencies. This ensures that only the expected versions of dependencies are installed.

🔴 CRITICAL: Potential Sandbox Escape in `benchmarks.yml`

The benchmarks.yml workflow installs dependencies using pip install -e ".[dev]". This allows the execution of arbitrary code during the installation process if the repository contains malicious code in its setup.py or pyproject.toml.

Recommendation:

Use a virtual environment or containerized environment for running benchmarks to isolate the execution environment.
Consider using a read-only filesystem for the container to prevent unintended modifications.

🟡 WARNING: Potential Breaking Changes in Dependency Versions

The PR pins pytest to version 8.4.1 and pytest-asyncio to version 0.26.0. While this improves reproducibility, it may cause issues for users who rely on newer versions of these dependencies.

Recommendation:

Clearly document the rationale for pinning these versions in the CHANGELOG.md and/or README.md.
Consider using semantic versioning ranges (e.g., pytest>=8.4,<9.0) to allow for minor updates while avoiding breaking changes.

🟡 WARNING: Backward Compatibility for `pyyaml` Version Pinning

The pyyaml dependency is pinned to version 6.0.2. This may break compatibility for users who rely on other versions of pyyaml.

Recommendation:

Evaluate whether pinning pyyaml to a specific version is strictly necessary. If it is, document the reason for this decision in the CHANGELOG.md and/or README.md.

💡 SUGGESTION: Use `actions/checkout@v4` Instead of Commit Hash

The workflows use a specific commit hash (11bd71901bbe5b1630ceea73d27597364c9af683) for the actions/checkout action. While this ensures stability, it may lead to missing out on important updates or security patches.

Recommendation:

Use the latest stable version tag (e.g., actions/checkout@v4) to balance stability and security.

💡 SUGGESTION: Add Tests for Policy Engine Changes

While this PR does not directly modify the policy engine, it is critical to ensure that the changes to CI/CD workflows do not inadvertently affect the correctness of the policy engine.

Recommendation:

Add automated tests to validate the policy engine's behavior under different scenarios, especially for edge cases.

💡 SUGGESTION: Document MSRC Case Reference

The comments referencing "MSRC Case 111178" are helpful for context but may not be accessible to all contributors.

Recommendation:

Provide a brief explanation or link to public documentation (if available) about the MSRC case to help contributors understand the rationale behind these changes.

Final Assessment

The PR makes significant improvements to the repository's security posture, particularly in addressing dangerous workflows and adding signed releases. However, critical gaps in signature verification and dependency integrity checks must be addressed before merging. Additionally, the potential breaking changes introduced by dependency pinning should be carefully documented to ensure backward compatibility.

Action Items

🔴 Address critical issues:
- Add Sigstore signature verification.
- Implement hash-based integrity checks for pip install.
- Isolate benchmark execution to prevent sandbox escapes.
🟡 Mitigate potential breaking changes:
- Document the rationale for dependency pinning.
- Consider using semantic versioning ranges where possible.
💡 Implement suggestions:
- Use stable version tags for GitHub Actions.
- Add tests for policy engine correctness.
- Provide context for MSRC case references.

github-actions · 2026-03-24T00:00:01Z

🤖 AI Agent: security-scanner — Security Review of Pull Request

Security Review of Pull Request

This pull request addresses several security-related improvements in the GitHub Actions workflows, including changes to address dangerous workflows, enforce signed releases, and pin dependencies. Below is a detailed security review of the changes.

Findings

1. Dangerous Workflow Mitigation

Change: Removed explicit ref: ${{ github.event.pull_request.head.sha }} in workflows triggered by pull_request_target events.
Risk: 🔴 CRITICAL
- The pull_request_target event runs workflows in the context of the base branch but allows access to the contents of the pull request. Using ref: ${{ github.event.pull_request.head.sha }} in this context would allow an attacker to execute malicious code in the workflow by submitting a pull request with a modified workflow file. This could lead to privilege escalation or compromise of secrets.
Fix: The PR correctly removes the explicit ref and relies on the default behavior of pull_request_target, which checks out the base branch. This mitigates the risk of executing untrusted code from a pull request.
Recommendation: Ensure that all workflows triggered by pull_request_target events avoid using ref: head.sha or similar constructs. This change is correct and improves security.

2. Signed Releases

Change: Added a step to sign release artifacts using sigstore/gh-action-sigstore-python.
Risk: 🟠 HIGH
- Without signing release artifacts, attackers could tamper with the artifacts during the build or distribution process, leading to supply chain attacks.
Fix: The addition of the sigstore action to sign release artifacts is a strong improvement. However, there is no verification step to ensure the signature is valid after signing. This could lead to a false sense of security if the signing process is compromised.
Recommendation: Add a verification step to confirm that the signature is valid after signing. This ensures that the signing process itself has not been tampered with.

3. Pinned Dependencies

Change: Pinned dependencies in CI workflows (e.g., pytest==8.4.1, pytest-asyncio==0.26.0, pyyaml==6.0.2).
Risk: 🟡 MEDIUM
- Unpinned dependencies in CI workflows can lead to supply chain attacks, where malicious versions of dependencies are introduced.
Fix: Pinning dependencies to specific versions reduces the risk of supply chain attacks. However, the PR does not include a mechanism to automatically update and audit these dependencies, which could lead to outdated and vulnerable dependencies over time.
Recommendation: Use a dependency management tool (e.g., dependabot, pip-tools) to automate updates and audits of pinned dependencies.

4. Use of `--no-cache-dir` in `pip install`

Change: Added --no-cache-dir to pip install commands.
Risk: 🔵 LOW
- The use of --no-cache-dir prevents caching of downloaded packages, reducing the risk of using stale or tampered cache files. However, this is a minor improvement and does not address critical risks.
Fix: This change is a good practice and reduces potential attack vectors.
Recommendation: No further action required.

5. SPDX License Compliance

Change: No changes related to SPDX license compliance were observed.
Risk: 🔵 LOW
- There is no indication of license compliance issues in this PR. However, ensuring that all dependencies are properly licensed is a good practice.
Recommendation: Periodically audit dependencies for license compliance.

Summary of Findings

Finding	Risk	Recommendation
Dangerous Workflow Mitigation	🔴 CRITICAL	Ensure no workflows use `ref: head.sha` in `pull_request_target` context.
Signed Releases	🟠 HIGH	Add a verification step to confirm the validity of signatures after signing.
Pinned Dependencies	🟡 MEDIUM	Use a dependency management tool to automate updates and audits of dependencies.
Use of `--no-cache-dir` in `pip install`	🔵 LOW	No further action required.
SPDX License Compliance	🔵 LOW	Periodically audit dependencies for license compliance.

Final Assessment

This pull request makes significant improvements to the security posture of the repository by addressing dangerous workflows, introducing signed releases, and pinning dependencies. However, there are still areas for improvement, particularly around verifying signed artifacts and automating dependency updates.

Overall Risk Rating: 🟠 HIGH
Approval Recommendation: Approve with the condition that a follow-up PR addresses the recommendations for signed release verification and dependency management.

…rosoft#356) * docs: add testing guide for external testers and customers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add regulatory alignment table and Purview positioning to README Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): restore read-all at workflow level for Scorecard verification The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add comprehensive docstrings to mcp_adapter.py classes (microsoft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316 * ci: add markdown link checker workflow (microsoft#323) Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (microsoft#326) * fix: remove unregistered PyPI packages from notebooks and requirements (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package * fix(security): complete dependency confusion fix — replace all pip install agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update framework star counts to current values Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat(security): add dependency confusion pre-commit hook + weekly audit CI - scripts/check_dependency_confusion.py: Pre-commit hook that scans for pip install commands referencing unregistered PyPI packages. Maintains an allowlist of known registered packages. - .github/workflows/weekly-security-audit.yml: Weekly CI job running dependency confusion scan, security skills scan, and weak crypto check. Uploads reports as artifacts with 90-day retention. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(security): proactive audit — dependency confusion + MD5→SHA-256 (microsoft#349) * docs: add testing guide for external testers and customers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add regulatory alignment table and Purview positioning to README Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): restore read-all at workflow level for Scorecard verification The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add comprehensive docstrings to mcp_adapter.py classes (microsoft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316 * ci: add markdown link checker workflow (microsoft#323) Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (microsoft#326) * fix: remove unregistered PyPI packages from notebooks and requirements (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package * fix(security): complete dependency confusion fix — replace all pip install agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update framework star counts to current values Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Parsa Faraji Alamouti <165321600+parsa-faraji@users.noreply.github.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Zeel Desai <72783325+zeel2104@users.noreply.github.com> Co-authored-by: Xavier Garceau-Aranda <xavier.garceau-aranda@posteo.net> * fix(security): replace unregistered package names + MD5→SHA-256 - agentmesh → agentmesh-platform (5 files) - agentmesh-governance → agent-governance-toolkit - agent-os-observability → agent-os-kernel[observability] - hashlib.md5 → hashlib.sha256 (3 files) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(scorecard): remove explicit ref in pull_request_target, add sigstore, pin CI deps Dangerous-Workflow: Remove ref: base.sha from pull_request_target workflows — default checkout IS the base branch, explicit ref triggers Scorecard false positive. Security preserved via persist-credentials: false + MSRC comments. Signed-Releases: Add sigstore/gh-action-sigstore-python to publish workflow for Python package signing alongside existing attest-build-provenance. Pinned-Dependencies: Pin pip install versions in CI workflows: - ci.yml: pytest==8.4.1, pytest-asyncio==0.26.0 - benchmarks.yml: add --no-cache-dir - security-scan.yml: pyyaml==6.0.2 - weekly-security-audit.yml: pyyaml==6.0.2 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Parsa Faraji Alamouti <165321600+parsa-faraji@users.noreply.github.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Zeel Desai <72783325+zeel2104@users.noreply.github.com> Co-authored-by: Xavier Garceau-Aranda <xavier.garceau-aranda@posteo.net>

imran-siddique and others added 22 commits March 20, 2026 10:56

docs: add testing guide for external testers and customers

9bd6672

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

3ab4a65

…toolkit

ci: add markdown link checker workflow (microsoft#323)

baeed60

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (m…

8ee3c81

…icrosoft#326)

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

96b2046

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

3ac1f73

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

d0681ff

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

60bdccd

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

f87284e

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

ad5e9b1

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

77b4f72

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

d3a33a3

…toolkit

imran-siddique merged commit af47f64 into microsoft:main Mar 23, 2026
53 checks passed

github-actions bot added ci/cd CI/CD and workflows size/S Small PR (< 50 lines) labels Mar 23, 2026

github-actions bot reviewed Mar 23, 2026

View reviewed changes

imran-siddique deleted the fix/scorecard-full-sweep branch March 28, 2026 16:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(scorecard): dangerous-workflow, signed-releases, pinned-deps#356

fix(scorecard): dangerous-workflow, signed-releases, pinned-deps#356
imran-siddique merged 22 commits intomicrosoft:mainfrom
imran-siddique:fix/scorecard-full-sweep

imran-siddique commented Mar 23, 2026

Uh oh!

Uh oh!

github-actions bot left a comment

Uh oh!

github-actions bot commented Mar 24, 2026

Security Review of Pull Request

Findings

1. Dangerous Workflow Mitigation

2. Signed Releases

3. Pinned Dependencies

4. Use of `--no-cache-dir` in `pip install`

5. SPDX License Compliance

Summary of Findings

Final Assessment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

imran-siddique commented Mar 23, 2026

Uh oh!

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

🤖 AI Agent: code-reviewer

Review Summary

Key Issues and Recommendations

🔴 CRITICAL: Missing Verification of Sigstore Signatures

🔴 CRITICAL: Lack of Integrity Verification for pip install

🔴 CRITICAL: Potential Sandbox Escape in benchmarks.yml

🟡 WARNING: Potential Breaking Changes in Dependency Versions

🟡 WARNING: Backward Compatibility for pyyaml Version Pinning

💡 SUGGESTION: Use actions/checkout@v4 Instead of Commit Hash

💡 SUGGESTION: Add Tests for Policy Engine Changes

💡 SUGGESTION: Document MSRC Case Reference

Final Assessment

Action Items

Uh oh!

github-actions bot commented Mar 24, 2026

Security Review of Pull Request

Findings

1. Dangerous Workflow Mitigation

2. Signed Releases

3. Pinned Dependencies

4. Use of --no-cache-dir in pip install

5. SPDX License Compliance

Summary of Findings

Final Assessment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

🔴 CRITICAL: Lack of Integrity Verification for `pip install`

🔴 CRITICAL: Potential Sandbox Escape in `benchmarks.yml`

🟡 WARNING: Backward Compatibility for `pyyaml` Version Pinning

💡 SUGGESTION: Use `actions/checkout@v4` Instead of Commit Hash

4. Use of `--no-cache-dir` in `pip install`