chore(deps): bump starlette from 1.0.0 to 1.3.1 in /services/transcribe-worker #3006
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # merge_group: re-scan the queue's ahead-of-time merged commit to | |
| # catch security regressions introduced by two simultaneously-merging | |
| # PRs interacting. | |
| merge_group: | |
| schedule: | |
| - cron: '17 13 * * 1' # weekly, Monday 13:17 UTC (offset to avoid GHA peak congestion) | |
| # Cancel in-progress runs on the same PR (or branch ref for push events) | |
| # when a new commit / event arrives. Without this, every old run sat in | |
| # queued status holding a runner slot until it ran or naturally aged | |
| # out, which gridlocked the GitHub Actions queue on 2026-05-08 when | |
| # rapid close+reopen + force-push activity flooded the runner pool. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ['actions'] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # config-file points at .github/codeql/config.yml which | |
| # references both the GitHub-maintained `security-and-quality` | |
| # suite AND the Panakoes-specific .qls. The inline `queries:` | |
| # input does not accept repo-relative paths in codeql-action | |
| # v4 (rejects with "Specifier for external repository is | |
| # invalid"); the config-file form does. | |
| config-file: ./.github/codeql/config.yml | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v4 | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| # Companion shell scanners for bug classes CodeQL has no first-class | |
| # extractor for (Terraform HCL, raw text). Each script emits SARIF | |
| # 2.1.0 and uploads via codeql-action/upload-sarif. Report-only: | |
| # continue-on-error: true and no required-status-check gating until | |
| # the existing findings on main are triaged. See | |
| # .github/codeql/README.md for the full rationale. | |
| panakoes-scanners: | |
| name: Panakoes custom scanners | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Scan IAM resource="*" outside allowlist | |
| continue-on-error: true | |
| run: bash .github/codeql/scripts/scan-iam-star.sh iam-star.sarif | |
| - name: Scan TF variable defaults for secret patterns | |
| continue-on-error: true | |
| run: bash .github/codeql/scripts/scan-tf-secrets.sh tf-secrets.sarif | |
| - name: Scan for em-dash / en-dash in source | |
| continue-on-error: true | |
| run: bash .github/codeql/scripts/scan-em-dash.sh em-dash.sarif | |
| - name: Scan for AUTH_JWT_* outside services/auth | |
| continue-on-error: true | |
| run: bash .github/codeql/scripts/scan-jwt-prefix.sh jwt-prefix.sarif | |
| - name: Upload IAM-star SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: iam-star.sarif | |
| category: panakoes-iam-star | |
| - name: Upload TF-secrets SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: tf-secrets.sarif | |
| category: panakoes-tf-secrets | |
| - name: Upload em-dash SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: em-dash.sarif | |
| category: panakoes-em-dash | |
| - name: Upload JWT-prefix SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: jwt-prefix.sarif | |
| category: panakoes-jwt-prefix |