docs(security): document accepted Token-Permissions risks and add lint:dependency-pinning by WilliamBerryiii · Pull Request #763 · microsoft/hve-core

WilliamBerryiii · 2026-02-24T22:27:02Z

Pull Request

Description

Addresses two related security documentation and tooling gaps:

Token-Permissions documentation — OpenSSF Scorecard flags security-events: write across nine workflow files as overly broad. This permission is required for github/codeql-action/upload-sarif and github/codeql-action/analyze to upload SARIF results to the Security tab. Rather than suppressing the alert, this PR documents the accepted risk directly in the threat model and annotates every elevated permission line with an inline comment explaining its purpose.
Dependency-pinning lint script — Adds lint:dependency-pinning as an npm script wrapping Test-DependencyPinning.ps1 -FailOnUnpinned, and integrates it into the lint:all chain so dependency pinning compliance is validated alongside all other lint checks.

Changes

docs/security/threat-model.md — Expand E-1 (Workflow Token Abuse) with an "Accepted Risk: Token-Permissions Alerts" subsection documenting the rationale, affected workflows (9 jobs across 5 workflow files), and defense-in-depth controls. Update E-1 status to "Mitigated with Accepted Risk" and add inline comments to mitigations.
9 workflow files — Annotate all 14 security-events: write declarations with # Required for SARIF upload to Security tab inline comments for auditability.
package.json — Add lint:dependency-pinning npm script and append it to the lint:all chain.

Related Issue(s)

Closes #460
Closes #529

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)
Copilot skill (.github/skills/*/SKILL.md)

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Testing

npm run format:tables — passed
npm run lint:md — passed
npm run lint:yaml — passed
npm run lint:permissions — passed
npm run lint:dependency-pinning — passed (100% compliance, 0 violations)
npm run lint:all — full chain passed (all lint commands + validate:skills)
Manual testing was not performed; changes are documentation and configuration only.

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (N/A — no new testable code)

AI Artifact Contributions

Used /prompt-analyze to review contribution (N/A — no AI artifacts changed)
Addressed all feedback from prompt-builder review (N/A)
Verified contribution follows common standards and type-specific requirements (N/A)

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Skill structure validation: npm run validate:skills
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

🔒 - Generated by Copilot

…t:dependency-pinning - expand threat-model E-1 with accepted risk subsection for security-events: write - annotate 14 workflow permission lines with inline SARIF-upload comments - add lint:dependency-pinning npm script and include in lint:all chain Closes #460, closes #529 🔒 - Generated by Copilot

github-actions · 2026-02-24T22:27:24Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

## Pre-Release 3.1.44 ### ✨ Features - add Docusaurus 3 documentation site with GitHub Pages deployment (#680) - add workflow permissions validation for OpenSSF Scorecard compliance (#759) - add DT coach return path handoff to task-researcher (#591) (#758) - add DT subagent handoff workflow instructions (#592) (#757) - create dt-method-06-deep.instructions.md (#602) (#748) - create dt-method-05-deep.instructions.md (#747) - add DT-aware task-implementor context instructions (#755) - extract embedded PowerShell from workflows into testable scripts (#738) - add gitleaks binary-based secret scanning as PR gate (#734) - add SBOM generation, attestation, and diff tooling to release pipeline (#730) - add dt-learning-tutor agent for DT education (#662) - add DT image prompt generation guidance for Method 5 (#726) - add DT-aware task-reviewer review context (#714) - add dt-method-next routing prompt (#713) - create dt-method-04-deep.instructions.md (#709) - add Implementation Space exit handoff prompt for DT workflows (#708) - add Write-CIStepSummary markdown table to Test-SHAStaleness github output (#660) - add dt-handoff-solution-space prompt for Solution Spac… (#707) ### 🐛 Bug Fixes - update sidebar link color to meet WCAG AA contrast requirements (#814) - harden even/odd versioning against regression and syntax errors (#816) - replace even/odd versioning with SemVer -rc.N suffixes (#811) - ensure prerelease label exists before PR creation (#806) - replace Docusaurus favicons with Microsoft logo (#808) - add missing subagents and shared instructions to collection manifests (#804) - standardize file path conventions for copilot-tracking output (#784) - enforce project-scoped artifact isolation across DT files (#766) - add top-level permissions to copilot-setup-steps.yml (#760) - update broken file directives and markdown links after collection directory reorg (#743) - add pre-release companion pipeline with even/odd versioning (#735) - exclude auto-generated CHANGELOG.md from spell check (#756) - add job-level permissions to extension-publish.yml (#729) - resolve handoff dependencies using display names (#727) - add job-level permissions to validate-version in extension-publish-prerelease (#731) - replace parent-directory VS Code settings paths with per-subdirectory enumeration (#732) ### 📚 Documentation - add Design Thinking documentation and DT-to-RPI handoff (#789) - add customization guides for HVE Core artifacts (#772) - reconcile documentation against implementation (#771) - document accepted Token-Permissions risks and add lint:dependency-pinning (#763) - add Design Thinking section to hve-core-all collection description (#762) ### ♻️ Refactoring - move collection scripts from plugins to collections (#728) - remove duplicate git diff logic in frontmatter validator (#473) ### 🔧 Maintenance - bump basic-ftp from 5.0.5 to 5.2.0 (#780) - standardize script path references in SKILL.md files (#768) - bump the github-actions group across 1 directory with 2 updates (#752) --- *Managed automatically by pre-release workflow.* Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Pre-Release 3.1.46 ### ✨ Features - add Docusaurus 3 documentation site with GitHub Pages deployment (#680) - add workflow permissions validation for OpenSSF Scorecard compliance (#759) - add DT coach return path handoff to task-researcher (#591) (#758) - add DT subagent handoff workflow instructions (#592) (#757) - create dt-method-06-deep.instructions.md (#602) (#748) - create dt-method-05-deep.instructions.md (#747) - add DT-aware task-implementor context instructions (#755) - extract embedded PowerShell from workflows into testable scripts (#738) - add gitleaks binary-based secret scanning as PR gate (#734) - add SBOM generation, attestation, and diff tooling to release pipeline (#730) - add dt-learning-tutor agent for DT education (#662) - add DT image prompt generation guidance for Method 5 (#726) - add DT-aware task-reviewer review context (#714) - add dt-method-next routing prompt (#713) - create dt-method-04-deep.instructions.md (#709) - add Implementation Space exit handoff prompt for DT workflows (#708) - add Write-CIStepSummary markdown table to Test-SHAStaleness github output (#660) - add dt-handoff-solution-space prompt for Solution Spac… (#707) ### 🐛 Bug Fixes - update prerelease publish to use even/odd convention (#822) - update sidebar link color to meet WCAG AA contrast requirements (#814) - harden even/odd versioning against regression and syntax errors (#816) - replace even/odd versioning with SemVer -rc.N suffixes (#811) - ensure prerelease label exists before PR creation (#806) - replace Docusaurus favicons with Microsoft logo (#808) - add missing subagents and shared instructions to collection manifests (#804) - standardize file path conventions for copilot-tracking output (#784) - enforce project-scoped artifact isolation across DT files (#766) - add top-level permissions to copilot-setup-steps.yml (#760) - update broken file directives and markdown links after collection directory reorg (#743) - add pre-release companion pipeline with even/odd versioning (#735) - exclude auto-generated CHANGELOG.md from spell check (#756) - add job-level permissions to extension-publish.yml (#729) - resolve handoff dependencies using display names (#727) - add job-level permissions to validate-version in extension-publish-prerelease (#731) - replace parent-directory VS Code settings paths with per-subdirectory enumeration (#732) ### 📚 Documentation - add Design Thinking documentation and DT-to-RPI handoff (#789) - add customization guides for HVE Core artifacts (#772) - reconcile documentation against implementation (#771) - document accepted Token-Permissions risks and add lint:dependency-pinning (#763) - add Design Thinking section to hve-core-all collection description (#762) ### ♻️ Refactoring - move collection scripts from plugins to collections (#728) - remove duplicate git diff logic in frontmatter validator (#473) ### 🔧 Maintenance - pre-release 3.1.44 (#819) - bump basic-ftp from 5.0.5 to 5.2.0 (#780) - standardize script path references in SKILL.md files (#768) - bump the github-actions group across 1 directory with 2 updates (#752) --- *Managed automatically by pre-release workflow.* Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

WilliamBerryiii requested a review from a team as a code owner February 24, 2026 22:27

katriendg approved these changes Feb 25, 2026

View reviewed changes

WilliamBerryiii merged commit 1601d7d into main Feb 25, 2026
23 checks passed

hve-core-release-please bot mentioned this pull request Feb 28, 2026

chore(main): pre-release 3.1.46 #823

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs(security): document accepted Token-Permissions risks and add lint:dependency-pinning#763

docs(security): document accepted Token-Permissions risks and add lint:dependency-pinning#763
WilliamBerryiii merged 1 commit intomainfrom
docs/token-permissions-and-dependency-pinning-460-529

WilliamBerryiii commented Feb 24, 2026

Uh oh!

github-actions bot commented Feb 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

WilliamBerryiii commented Feb 24, 2026

Pull Request

Description

Changes

Related Issue(s)

Type of Change

Testing

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Uh oh!

github-actions bot commented Feb 24, 2026

Dependency Review

Scanned Files

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants