From cb19bcd1d76112c2ed0e21a8b047f35410f72509 Mon Sep 17 00:00:00 2001 From: Ryan Morris Date: Thu, 15 Oct 2026 11:12:08 -0500 Subject: [PATCH] ci: CodeQL as a workflow, and a SECURITY.md codeql.yml runs CodeQL on the code and the workflows (actions, javascript-typescript) with the security-and-quality queries on pull requests, main and weekly, in place of GitHub's default setup, so the queries and languages are in the repository. SECURITY.md says what is supported and links private vulnerability reporting. The README's CI convention lists both. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/codeql.yml | 41 ++++++++++++++++++++++++++++++++++++ README.md | 6 ++++++ SECURITY.md | 18 ++++++++++++++++ pnpm-lock.yaml | 25 ++++++++++++++++++++++ 4 files changed, 90 insertions(+) create mode 100644 .github/workflows/codeql.yml create mode 100644 SECURITY.md diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..8fac23f --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,41 @@ +# CodeQL on the TypeScript and the workflows, with the security-and-quality queries: on every pull request, on main and +# weekly for newly published queries. Results go to the Security tab; the main ruleset requires them. +name: CodeQL +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: '23 4 * * 1' + +permissions: {} + +concurrency: + group: codeql-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: read + security-events: write # uploads the results + strategy: + fail-fast: false + matrix: + language: [actions, javascript-typescript] + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + with: + languages: ${{ matrix.language }} + build-mode: none + queries: security-and-quality + - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 + with: + category: /language:${{ matrix.language }} diff --git a/README.md b/README.md index 1fb5c8c..515db95 100644 --- a/README.md +++ b/README.md @@ -213,6 +213,12 @@ that does nothing. required status check. - **`scorecard.yml`**: [OpenSSF Scorecard](https://scorecard.dev) on pushes to `main` and weekly. Its own workflow because publishing results restricts what else the workflow may contain. +- **`codeql.yml`**: CodeQL on the code and the workflows (`actions`, `javascript-typescript`) with the + `security-and-quality` queries, on pull requests, `main` and weekly. A workflow rather than GitHub's + default setup, so the queries and languages are in the repository; the `main` ruleset requires its + results. (Turn the default setup off: GitHub rejects a workflow's results while it is on.) +- **`SECURITY.md`**: supported versions and a link to private vulnerability reporting (enabled in the + repository settings). - **`.github/dependabot.yml`** with a 7-day cooldown. - Bot actions (Dependabot auto-merge) run as the devenvy-bot GitHub App — org variable `DEVENVY_BOT_CLIENT_ID`, org secret `DEVENVY_BOT_PRIVATE_KEY`, both also as Dependabot secrets — diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d9b3887 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,18 @@ +# Security + +## Supported versions + +| Version | Supported | +| --------------------------------------------- | -------------------------------- | +| The latest `@devenvy/code-guidelines` release | Yes: fixes ship as a new release | +| Older releases | No: update to the latest | + +## Reporting a vulnerability + +Please report vulnerabilities privately, through GitHub's private vulnerability reporting: +[report a vulnerability](https://github.com/devenvy/code-guidelines-ecma/security/advisories/new) (Security, +Advisories, **Report a vulnerability**). Please don't open a public issue. You'll get an answer within a week, and the +fix and advisory are published together. + +In scope: the CLI (`init`, `sync`, `check` and what they write into a repository), the shared ESLint, Prettier and +tsconfig configurations, and the workflows. Vulnerabilities in ESLint, Prettier or their plugins belong upstream. diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 25e77ff..64d82fd 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,6 +6,9 @@ importers: .: configDependencies: {} packageManagerDependencies: + '@pnpm/exe': + specifier: 12.11.2 + version: 12.11.2 pnpm: specifier: 12.11.2 version: 12.11.2 @@ -89,6 +92,11 @@ packages: cpu: [x64] os: [win32] + '@pnpm/exe@12.11.2': + resolution: {integrity: sha512-uUudrvXShgp6yYRL/6XjeB2B2kbjE/alBdVWjFBP0jDiOnV5R83OpCWuGtc+Tn4stk0DEgO/x+vhEUTUf4x+Yw==} + engines: {node: '>=18.*'} + hasBin: true + pnpm@12.11.2: resolution: {integrity: sha512-JaUWUqGWeFr18ovabf6NxYLr76SsHRgCIc4TkCMcX7dmN4IupLbkYzznSs3LCnf3Ja8RutOBd/3t2u6BipVcuQ==} engines: {node: '>=18.*'} @@ -138,6 +146,23 @@ snapshots: '@pnpm/exe.win32-x64@12.11.2': optional: true + '@pnpm/exe@12.11.2': + optionalDependencies: + '@pnpm/exe.android-arm64': 12.11.2 + '@pnpm/exe.android-x64': 12.11.2 + '@pnpm/exe.darwin-arm64': 12.11.2 + '@pnpm/exe.darwin-x64': 12.11.2 + '@pnpm/exe.freebsd-x64': 12.11.2 + '@pnpm/exe.linux-arm64': 12.11.2 + '@pnpm/exe.linux-arm64-musl': 12.11.2 + '@pnpm/exe.linux-ppc64': 12.11.2 + '@pnpm/exe.linux-riscv64': 12.11.2 + '@pnpm/exe.linux-s390x': 12.11.2 + '@pnpm/exe.linux-x64': 12.11.2 + '@pnpm/exe.linux-x64-musl': 12.11.2 + '@pnpm/exe.win32-arm64': 12.11.2 + '@pnpm/exe.win32-x64': 12.11.2 + pnpm@12.11.2: optionalDependencies: '@pnpm/exe.android-arm64': 12.11.2