Repository navigation
fix: add codeql.yml for CodeQL SAST compliance #84
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,35 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||
| # CodeQL SAST analysis for the .github standards repository. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| # This repo contains GitHub Actions workflows, so 'actions' is the configured language. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| # Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#2-codeql-analysis-codeqlyml | ||||||||||||||||||||||||||||||||||||||||||||||||||
| name: CodeQL Analysis | ||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||
| permissions: {} | ||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||||||||||||||||||||
| push: | ||||||||||||||||||||||||||||||||||||||||||||||||||
| branches: [main] | ||||||||||||||||||||||||||||||||||||||||||||||||||
| pull_request: | ||||||||||||||||||||||||||||||||||||||||||||||||||
| branches: [main] | ||||||||||||||||||||||||||||||||||||||||||||||||||
| schedule: | ||||||||||||||||||||||||||||||||||||||||||||||||||
| - cron: '0 17 * * 5' # Weekly scan (Friday 12:00 PM EST / 17:00 UTC) | ||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||||||||||||||||||||
| analyze: | ||||||||||||||||||||||||||||||||||||||||||||||||||
| name: Analyze (actions) | ||||||||||||||||||||||||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | |
| runs-on: ubuntu-24.04 |
Copilot
AI
Apr 7, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The CodeQL actions are referenced by a moving tag (@v4). If your repo/org policy is aiming for supply-chain hardening (similar to the pinned actions/checkout), pin github/codeql-action/* to immutable commit SHAs as well (and keep them updated via Dependabot). This reduces the risk of a compromised upstream tag affecting your workflow.
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: actions | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| uses: github/codeql-action/init@3c5c3a4a0f3f64e64d5d4e9f7e3f2db279b9da86 # v4 | |
| with: | |
| languages: actions | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@3c5c3a4a0f3f64e64d5d4e9f7e3f2db279b9da86 # v4 |
Copilot
AI
Apr 7, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The CodeQL actions are referenced by a moving tag (@v4). If your repo/org policy is aiming for supply-chain hardening (similar to the pinned actions/checkout), pin github/codeql-action/* to immutable commit SHAs as well (and keep them updated via Dependabot). This reduces the risk of a compromised upstream tag affecting your workflow.
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: actions | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| uses: github/codeql-action/init@3fcb8f7314c2e7c6b6bc3b5b7f9a1f4e6d2c9a55 # v4 | |
| with: | |
| languages: actions | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@3fcb8f7314c2e7c6b6bc3b5b7f9a1f4e6d2c9a55 # v4 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The inline comment mixes a fixed UTC cron with a fixed 'EST' local time; this becomes inaccurate during daylight saving time (ET shifts between UTC-4/UTC-5). Prefer describing this as '12:00 PM ET' with a DST note, or remove the local-time conversion and keep the comment purely in UTC to avoid future confusion.