Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.65%. Comparing base (060f64d) to head (ef42b0f).

@@            Coverage Diff             @@
##             main    #1246      +/-   ##
==========================================
- Coverage   87.66%   87.65%   -0.02%     
==========================================
  Files          61       61              
  Lines        9328     9328              
==========================================
- Hits         8177     8176       -1     
- Misses       1151     1152       +1     

@JasonTheDeveloper - will you run this one over HVE Core itself and share the report in this thread?

@WilliamBerryiii yeah sure. I ran the owasp-cicd skill specifcally and here are the results:

OWASP Security Assessment Report

Date: 2026-04-01
Repository: hve-core
Agent: Security Reviewer
Skills applied: owasp-cicd

Executive Summary

A comprehensive CI/CD security assessment was performed against the hve-core repository using the OWASP CI/CD Top 10 framework. All 10 controls were evaluated, producing 9 PASS findings and 1 NOT_ASSESSED finding (IAM configuration, which resides outside source code). No vulnerabilities were identified — the repository demonstrates strong pipeline security posture with SHA-pinned actions, least-privilege permissions, secret scanning, SBOM generation, build provenance attestation, and deterministic dependency management. All 10 findings passed through verification unchanged.

Summary Counts

Severity Breakdown (FAIL + PARTIAL only)

Verification Summary

Findings by Framework

owasp-cicd

Detailed Remediation Guidance

None identified.

Disproved Findings

None.

Remediation Checklist

No CONFIRMED or DOWNGRADED findings require remediation.

Appendix: Skills Used

@WilliamBerryiii yeah sure. I ran the owasp-cicd skill specifcally and here are the results:

OWASP Security Assessment Report

Date: 2026-04-01 Repository: hve-core Agent: Security Reviewer Skills applied: owasp-cicd

Caution

This prompt is an assistive tool only and does not replace professional security tooling (SAST, DAST, SCA, penetration testing, compliance scanners) or qualified human review. All AI-generated vulnerability findings must be reviewed and validated by qualified security professionals before use. AI outputs may contain inaccuracies, miss critical threats, or produce recommendations that are incomplete or inappropriate for your environment.

Executive Summary

A comprehensive CI/CD security assessment was performed against the hve-core repository using the OWASP CI/CD Top 10 framework. All 10 controls were evaluated, producing 9 PASS findings and 1 NOT_ASSESSED finding (IAM configuration, which resides outside source code). No vulnerabilities were identified — the repository demonstrates strong pipeline security posture with SHA-pinned actions, least-privilege permissions, secret scanning, SBOM generation, build provenance attestation, and deterministic dependency management. All 10 findings passed through verification unchanged.

Summary Counts

Status Count
PASS 9
FAIL 0
PARTIAL 0
NOT_ASSESSED 1
Total 10

Severity Breakdown (FAIL + PARTIAL only)

Severity Count
CRITICAL 0
HIGH 0
MEDIUM 0
LOW 0

Verification Summary

Verdict Count
CONFIRMED 0
DISPROVED 0
DOWNGRADED 0
UNCHANGED 10

Findings by Framework

owasp-cicd

ID Title Status Severity Location Finding Recommendation Verdict Justification
CICD-SEC-1:2025 Insufficient Flow Control Mechanisms PASS N/A N/A PR validation runs on pull_request events against protected branches (main, develop). The stable release pipeline triggers only on push to main. Pre-release pipelines require merged PRs. All pipelines gate on multiple validation jobs before release steps execute. No auto-merge rules were found in the codebase. Continue enforcing branch protection rules at the GitHub repository settings level. UNCHANGED Pass-through; no adversarial verification required.
CICD-SEC-3:2025 Dependency Chain Abuse PASS N/A N/A The repository has a .npmrc enforcing save-exact=true, package-lock=true, and audit=true. Both package-lock.json and docs/docusaurus/package-lock.json exist for lockfile-based deterministic installs. All npm ci calls use lockfiles. Python dependencies use uv sync with uv.lock files. A dependency-review.yml workflow runs actions/dependency-review-action on PRs with license checks and OpenSSF Scorecard warnings. A pip-audit.yml workflow audits Python dependencies. Additionally, a dependency-pinning-scan.yml workflow enforces SHA pinning compliance for all dependency types. No additional action needed. UNCHANGED Pass-through; no adversarial verification required.
CICD-SEC-4:2025 Poisoned Pipeline Execution PASS N/A N/A All workflows trigger on pull_request (not pull_request_target), which runs with read-only GITHUB_TOKEN on the PR merge commit in a safe context. No workflows were found that trigger on pull_request_target. The PR validation pipeline uses only contents: read permissions. Release pipelines trigger on push to main (post-merge only). The copilot-setup-steps.yml triggers only on workflow_dispatch. Pipeline configuration files are in the repository with branch protection expected on main. Ensure branch protection rules on main require PR review before merge to prevent direct pushes that trigger the release pipeline. UNCHANGED Pass-through; no adversarial verification required.
CICD-SEC-5:2025 Insufficient PBAC PASS N/A N/A Every workflow declares top-level permissions: contents: read and then grants minimal per-job permissions (e.g., security-events: write only for SARIF upload jobs, id-token: write only for attestation/OIDC jobs). This follows the principle of least privilege extensively. The marketplace publish job uses a protected GitHub environment (marketplace). All jobs run on GitHub-hosted ubuntu-latest runners, which are ephemeral by design. No additional action needed. UNCHANGED Pass-through; no adversarial verification required.
CICD-SEC-6:2025 Insufficient Credential Hygiene PASS N/A N/A Gitleaks secret scanning runs on every PR (gitleaks-scan.yml) and as part of the stable release pipeline with soft-fail: false, blocking merges on detected secrets. Full git history is scanned (fetch-depth: 0). Secrets are stored in GitHub Secrets/Variables (e.g., RELEASE_APP_PRIVATE_KEY, AZURE_CLIENT_ID), never in code. Almost all checkout steps use persist-credentials: false to prevent token leakage. The marketplace publish uses OIDC federation (short-lived tokens) rather than static credentials. Continue periodic rotation of the GitHub App private key and Azure service principal credentials. UNCHANGED Pass-through; no adversarial verification required.
CICD-SEC-7:2025 Insecure System Configuration PASS N/A N/A All CI/CD runs on GitHub-hosted runners (ubuntu-latest), eliminating self-managed infrastructure risks. Workflows use concurrency groups with cancel-in-progress to prevent resource exhaustion. A workflow-permissions-scan.yml workflow validates that all workflows have proper permissions blocks. CodeQL analysis runs weekly and on PRs. The OpenSSF Scorecard runs weekly and after releases. ActionLint validates workflow syntax. No additional action needed. UNCHANGED Pass-through; no adversarial verification required.
CICD-SEC-8:2025 Ungoverned Usage of 3rd Party Services PASS N/A N/A All third-party GitHub Actions are pinned by full SHA with version comments (e.g., actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2). An action-version-consistency-scan.yml workflow ensures consistent action versions across all workflows. The dependency-pinning-scan.yml enforces SHA pinning compliance with a 95% threshold. The sha-staleness-check.yml detects outdated SHA pins. Third-party actions used are well-known. Weekly security maintenance reviews all third-party integrations. Periodically review the third-party action inventory for actions that are no longer maintained. Consider documenting the approval rationale for each third-party action. UNCHANGED Pass-through; no adversarial verification required.
CICD-SEC-9:2025 Improper Artifact Integrity Validation PASS N/A N/A The release pipelines generate SBOMs using anchore/sbom-action in SPDX JSON format for all artifacts (VSIX extensions, plugin packages, and dependencies). Build provenance is attested using actions/attest-build-provenance (Sigstore). SBOMs are independently attested via actions/attest. All release assets include .sigstore.json and .intoto.jsonl provenance bundles. Verification instructions are appended to release notes. Third-party tool downloads in workflows verify SHA256 checksums before use. The Get-VerifiedDownload.ps1 library script provides a reusable pattern for hash-verified downloads. No additional action needed. UNCHANGED Pass-through; no adversarial verification required.
CICD-SEC-10:2025 Insufficient Logging and Visibility PASS N/A N/A Multiple SARIF-producing workflows upload results to the GitHub Security tab: CodeQL, Gitleaks, dependency pinning scan, workflow permissions scan, action version consistency scan, and OpenSSF Scorecard. Workflow artifacts are retained (30–90 days) for audit trails. Job summaries are generated for visibility. Weekly security maintenance produces consolidated summary reports and creates GitHub issues for stale SHA pins. All security-relevant workflows run both on PRs and on schedule (weekly). Consider increasing artifact retention for security-sensitive scan results if organizational compliance requires longer retention periods. UNCHANGED Pass-through; no adversarial verification required.
CICD-SEC-2:2025 Inadequate Identity and Access Management NOT_ASSESSED N/A N/A IAM configuration lives in GitHub organization/repository settings and cannot be assessed from source code alone. Workflows use GitHub App tokens (actions/create-github-app-token) scoped via RELEASE_APP_ID / RELEASE_APP_PRIVATE_KEY rather than broad PATs, which is a positive signal. The marketplace publish workflow uses OIDC (azure/login with client-id, tenant-id, subscription-id) and a protected marketplace environment. Periodically audit GitHub organization member access, repository collaborators, and GitHub App installation permissions. Verify that the Release App has minimal required permissions. UNCHANGED Pass-through; not assessable from source code.

Detailed Remediation Guidance

None identified.

Disproved Findings

None.

Remediation Checklist

ID Control Status Evidence
No CONFIRMED or DOWNGRADED findings require remediation.

Appendix: Skills Used

Skill Framework Version Reference
owasp-cicd OWASP Top 10 CI/CD Security Risks 1.0.0 owasp.org/www-project-top-10-ci-cd-security-risks

This makes me really happy!

Thanks for the work, this looks good to me now.

@WilliamBerryiii if there is nothing missing around the trademark/copyright usage across the titles (just keeping the attribution and notice at the bottom of skill), then I think we can approve and merge?

@katriendg ... had a side chat with @JasonTheDeveloper and we agreed that we'd get these merged and fast follow with a bulk license update across the 3 so that we didn't duplicate work. Having that work in a single PR will make it easier for us to see how the third party notices are handled and ensure a uniform approach. I can also then follow that with some skill level automation to ensure we're taking a structured approach as we pull more skills in.