From faf86d602aa35b697de4f64903db66410606e6f9 Mon Sep 17 00:00:00 2001 From: jonahgabriel Date: Sat, 2 May 2026 10:44:49 -0400 Subject: [PATCH 1/6] ci(OMN-10445): self-scan local reusable codeql --- .github/workflows/security-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 2536fb26026..d9911168bd4 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -20,7 +20,7 @@ on: jobs: codeql: name: CodeQL - uses: OmniNode-ai/onex_change_control/.github/workflows/codeql-reusable.yml@main + uses: ./.github/workflows/codeql-reusable.yml with: language: python query_suite: security-and-quality From a58a45acd5d157397c6ce27bd5dd6533921032e9 Mon Sep 17 00:00:00 2001 From: jonahgabriel Date: Sat, 2 May 2026 10:46:28 -0400 Subject: [PATCH 2/6] ci(OMN-10445): run OCC codeql on selector runners --- .github/workflows/security-scan.yml | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index d9911168bd4..cefd48066a3 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -20,11 +20,32 @@ on: jobs: codeql: name: CodeQL - uses: ./.github/workflows/codeql-reusable.yml - with: - language: python - query_suite: security-and-quality + runs-on: >- + ${{ + (github.event_name == 'pull_request' && + github.event.pull_request.head.repo.full_name != github.repository) + && fromJSON(vars.OMNI_PUBLIC_PR_RUNS_ON_JSON) + || fromJSON(vars.OMNI_TRUSTED_CI_RUNS_ON_JSON) + }} permissions: actions: read contents: read security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@v6 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v4 + with: + languages: python + queries: security-and-quality + + - name: Autobuild + uses: github/codeql-action/autobuild@v4 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v4 + with: + category: /language:python From 76449c61c160f8be9c6335be687e7e323be4253e Mon Sep 17 00:00:00 2001 From: jonahgabriel Date: Sat, 2 May 2026 11:52:31 -0400 Subject: [PATCH 3/6] ci(OMN-10445): preserve CodeQL required check name --- .github/workflows/security-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index cefd48066a3..0c718f58653 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -19,7 +19,7 @@ on: jobs: codeql: - name: CodeQL + name: CodeQL Analysis (python) runs-on: >- ${{ (github.event_name == 'pull_request' && From 4e99e0de0ed202259ef614f8cc106658580f58f0 Mon Sep 17 00:00:00 2001 From: jonahgabriel Date: Sat, 2 May 2026 11:53:15 -0400 Subject: [PATCH 4/6] ci(OMN-10445): match protected CodeQL context --- .github/workflows/security-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 0c718f58653..dbd73843b56 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -19,7 +19,7 @@ on: jobs: codeql: - name: CodeQL Analysis (python) + name: CodeQL / CodeQL Analysis (python) runs-on: >- ${{ (github.event_name == 'pull_request' && From 594d350391a6cff3b0118f6dcd66a01212577a26 Mon Sep 17 00:00:00 2001 From: jonahgabriel Date: Sat, 2 May 2026 12:03:42 -0400 Subject: [PATCH 5/6] ci(OMN-10445): pin security scan actions --- .github/workflows/security-scan.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index dbd73843b56..9cae3651824 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -34,18 +34,18 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4 with: languages: python queries: security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@v4 + uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4 with: category: /language:python From dc2f727c4ad91d1c37fe50cf7fa1a9fbf741786a Mon Sep 17 00:00:00 2001 From: jonahgabriel Date: Sat, 2 May 2026 12:04:29 -0400 Subject: [PATCH 6/6] ci(OMN-10445): keep security scan actions standardized --- .github/workflows/security-scan.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 9cae3651824..dbd73843b56 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -34,18 +34,18 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@v6 - name: Initialize CodeQL - uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4 + uses: github/codeql-action/init@v4 with: languages: python queries: security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4 + uses: github/codeql-action/autobuild@v4 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4 + uses: github/codeql-action/analyze@v4 with: category: /language:python