Skip to content

ci: solo-dev tooling bundle (zizmor, codeql, lychee, typos, deptry+vulture, mutmut, ADRs, OSSInsight) - #325

Merged
robotrocketscience merged 12 commits into
mainfrom
ci/devtools-bundle
Apr 30, 2026
Merged

ci: solo-dev tooling bundle (zizmor, codeql, lychee, typos, deptry+vulture, mutmut, ADRs, OSSInsight)#325
robotrocketscience merged 12 commits into
mainfrom
ci/devtools-bundle

ci: consolidate typos config into existing .typos.toml

1531a8e
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL succeeded Apr 30, 2026 in 3s

14 new alerts including 14 medium severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 14 medium

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 27 in .github/workflows/codeql.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'CodeQL' step
Uses Step
Loading
uses 'step-security/harden-runner' with ref 'v2', not a pinned commit hash

Check warning on line 20 in .github/workflows/deadcode.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'deadcode' step
Uses Step
Loading
uses 'step-security/harden-runner' with ref 'v2', not a pinned commit hash

Check warning on line 24 in .github/workflows/deadcode.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'deadcode' step
Uses Step
Loading
uses 'astral-sh/setup-uv' with ref 'v5', not a pinned commit hash

Check warning on line 33 in .github/workflows/deadcode.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'deadcode' step
Uses Step
Loading
uses 'step-security/harden-runner' with ref 'v2', not a pinned commit hash

Check warning on line 37 in .github/workflows/deadcode.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'deadcode' step
Uses Step
Loading
uses 'astral-sh/setup-uv' with ref 'v5', not a pinned commit hash

Check warning on line 20 in .github/workflows/link-check.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'link-check' step
Uses Step
Loading
uses 'step-security/harden-runner' with ref 'v2', not a pinned commit hash

Check warning on line 26 in .github/workflows/link-check.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'link-check' step
Uses Step: lychee
Loading
uses 'lycheeverse/lychee-action' with ref 'v2', not a pinned commit hash

Check warning on line 38 in .github/workflows/link-check.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'link-check' step
Uses Step
Loading
uses 'peter-evans/create-issue-from-file' with ref 'v5', not a pinned commit hash

Check warning on line 21 in .github/workflows/mutation.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'mutation' step
Uses Step
Loading
uses 'step-security/harden-runner' with ref 'v2', not a pinned commit hash

Check warning on line 25 in .github/workflows/mutation.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'mutation' step
Uses Step
Loading
uses 'astral-sh/setup-uv' with ref 'v5', not a pinned commit hash

Check warning on line 18 in .github/workflows/typos.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'typos' step
Uses Step
Loading
uses 'step-security/harden-runner' with ref 'v2', not a pinned commit hash

Check warning on line 22 in .github/workflows/typos.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'typos' step
Uses Step
Loading
uses 'crate-ci/typos' with ref 'master', not a pinned commit hash

Check warning on line 28 in .github/workflows/zizmor.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'zizmor' step
Uses Step
Loading
uses 'step-security/harden-runner' with ref 'v2', not a pinned commit hash

Check warning on line 32 in .github/workflows/zizmor.yml

See this annotation in the file changed.

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'zizmor' step
Uses Step
Loading
uses 'astral-sh/setup-uv' with ref 'v5', not a pinned commit hash