From efd875b328601930969a98c37f9076e3d44363ea Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 16:50:27 +0900 Subject: [PATCH 01/16] fix(security): keep every CodeQL Action phase on one revision Rebuild the PR from protected develop with only the atomic CodeQL lifecycle update, its test-first contract, doctoring record, and changelog entry. Remove unrelated PDF.js and npm lockfile drift from this branch. --- .github/workflows/codeql.yml | 6 +- .github/workflows/ossf-scorecard.yml | 2 +- .github/workflows/trivy.yml | 2 +- CHANGELOG.md | 4 ++ .../codeql-action-atomic-revision.md | 61 +++++++++++++++++++ .../test_codeql_action_revision_contract.py | 54 ++++++++++++++++ 6 files changed, 124 insertions(+), 5 deletions(-) create mode 100644 docs/doctoring/codeql-action-atomic-revision.md create mode 100644 services/analysis-engine/tests/test_codeql_action_revision_contract.py diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 27c5b540f..ee9b6019a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,8 +32,8 @@ jobs: - python steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: languages: ${{ matrix.language }} - - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 - - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 + - uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index 2a4b6eaa9..a3c287789 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -79,6 +79,6 @@ jobs: python3 trusted-scorecard-scripts/scripts/checks/normalize_scorecard_sarif.py scorecard-sarif/results.sarif normalized-scorecard-results.sarif - - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation. + - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6; immutable SHA pinning retained as supply-chain attack mitigation. with: sarif_file: normalized-scorecard-results.sarif diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index d79ec32e1..cd417efba 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -48,7 +48,7 @@ jobs: skip-dirs: 'services/analysis-engine/.venv' trivyignores: ./.trivyignore - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation. + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6; immutable SHA pinning retained as supply-chain attack mitigation. if: always() with: sarif_file: trivy-results.sarif diff --git a/CHANGELOG.md b/CHANGELOG.md index eea696893..105f06d26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ - Display the analyzed song tempo (BPM) as a badge in the rehearsal workspace. - 각 합주 역할(Role)별 개인 연습 진행도를 0~100% 범위로 기록 및 시각화할 수 있는 연습 진척도(`practiceProgress`) 트래커 기능 추가. UI 컨트롤(슬라이더 및 +/- 버튼)과 한/영 다국어 지원 포함. +### Changed + +- Updated every CodeQL Action phase and SARIF uploader together to the reviewed immutable `v4.37.6` revision, with a regression contract that prevents mixed `init`, `autobuild`, `analyze`, and `upload-sarif` versions. + ## [0.1.3] - 2026-04-29 ### Fixed diff --git a/docs/doctoring/codeql-action-atomic-revision.md b/docs/doctoring/codeql-action-atomic-revision.md new file mode 100644 index 000000000..61312f4fa --- /dev/null +++ b/docs/doctoring/codeql-action-atomic-revision.md @@ -0,0 +1,61 @@ +# Atomic CodeQL Action revision policy + +## Decision + +BandScope treats the CodeQL Action lifecycle as one supply-chain dependency. Every checked-in reference to `github/codeql-action/init`, `autobuild`, `analyze`, and `upload-sarif` must use the same reviewed full-length commit SHA and matching release annotation. + +The current reviewed revision is CodeQL Action `v4.37.6` at commit `5595ccaf912efad79be6eef63a5619ff05969be3`. + +GitHub documents `init` as the phase that initializes CodeQL, `autobuild` as the optional automatic build phase, and `analyze` as the phase that finalizes the database, runs queries, and uploads results. `upload-sarif` publishes SARIF generated by other tools. These phases exchange state and therefore move together in this repository rather than through independent dependency pull requests. + +## Threat and compatibility boundary + +A full commit SHA is the immutable execution identity. Tags remain useful release labels, but they are not accepted as the workflow execution reference. GitHub identifies a full-length commit SHA as the strongest immutable action reference and supports organization policy requiring that form. + +Independently updating one phase can leave the repository with mixed JavaScript bundles, CodeQL CLI expectations, feature flags, or SARIF transport behavior. Even when each individual release is valid, the mixed lifecycle has not been reviewed or tested as a unit. The atomic policy prevents both persistent drift and the transient mixed state that can occur when several Dependabot pull requests merge at different times. + +```mermaid +flowchart LR + A[CodeQL init] --> B[CodeQL autobuild] + B --> C[CodeQL analyze] + C --> D[GitHub code scanning] + E[Trivy and Scorecard SARIF] --> F[CodeQL upload-sarif] + R[One reviewed release SHA] --> A + R --> B + R --> C + R --> F +``` + +The change does not alter workflow triggers, language selection, build behavior, SARIF paths, permissions, or failure handling. It changes only the immutable CodeQL Action implementation identity and version comments. + +## Verification contract + +`services/analysis-engine/tests/test_codeql_action_revision_contract.py` scans every workflow and fails unless: + +1. all CodeQL Action phases use one exact reviewed SHA; +2. every reference carries the matching `v4.37.6` annotation; and +3. `codeql.yml` keeps `init`, `autobuild`, and `analyze` on that same revision. + +Repository CI, CodeQL, SAST, dependency/security scans, SBOM generation, central coverage evidence, automated review, independent approval, and branch protection must all validate the final exact head. Results from split predecessor pull requests are not transferable. + +## Update procedure + +1. Identify the newest supported CodeQL Action v4 release from the upstream GitHub repository. +2. Verify the tag resolves to the intended upstream commit and inspect the release notes. +3. Add or update the contract expectation first and observe the RED failure against the old revision. +4. Update every `init`, `autobuild`, `analyze`, and `upload-sarif` reference in one branch. +5. Run the focused contract, workflow/static checks, and the complete repository gates. +6. Merge only after exact-current-head review and branch protection succeed without bypass. +7. Close split dependency pull requests as superseded; do not reuse their checks or approvals. + +## Rollback + +Rollback restores the previously accepted full-length SHA across every CodeQL Action phase in one reviewed commit. A partial rollback is prohibited. After rollback, rerun the same exact-head security, quality, SARIF publication, and review gates before accepting the branch. + +## References + +GitHub. (2026). *CodeQL Action v4.37.6* [Software release]. https://github.com/github/codeql-action/releases/tag/v4.37.6 + +GitHub. (n.d.). *CodeQL code scanning for compiled languages*. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages + +GitHub. (n.d.). *Secure use reference*. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/actions/reference/security/secure-use diff --git a/services/analysis-engine/tests/test_codeql_action_revision_contract.py b/services/analysis-engine/tests/test_codeql_action_revision_contract.py new file mode 100644 index 000000000..1f9bc2d6f --- /dev/null +++ b/services/analysis-engine/tests/test_codeql_action_revision_contract.py @@ -0,0 +1,54 @@ +"""Supply-chain contracts for a coherent GitHub CodeQL Action revision.""" + +from __future__ import annotations + +import re +from pathlib import Path + +_REPOSITORY_ROOT = Path(__file__).resolve().parents[3] +_WORKFLOW_ROOT = _REPOSITORY_ROOT / ".github" / "workflows" +_EXPECTED_CODEQL_ACTION_SHA = "5595ccaf912efad79be6eef63a5619ff05969be3" +_EXPECTED_CODEQL_ACTION_VERSION = "v4.37.6" +_CODEQL_ACTION_REFERENCE = re.compile( + r"github/codeql-action/(init|autobuild|analyze|upload-sarif)@([0-9a-f]{40})([^\n]*)" +) + + +def _codeql_action_references() -> list[tuple[Path, str, str, str]]: + """Return every pinned CodeQL Action reference from checked-in workflows.""" + references: list[tuple[Path, str, str, str]] = [] + for workflow_path in sorted(_WORKFLOW_ROOT.glob("*.y*ml")): + workflow_text = workflow_path.read_text(encoding="utf-8") + for action_name, revision_sha, suffix in _CODEQL_ACTION_REFERENCE.findall(workflow_text): + references.append((workflow_path, action_name, revision_sha, suffix.strip())) + return references + + +def test_every_codeql_action_step_uses_the_same_reviewed_revision() -> None: + """Prevent independently updated phases from creating mixed CodeQL runtimes.""" + references = _codeql_action_references() + + assert references + assert {revision_sha for _, _, revision_sha, _ in references} == { + _EXPECTED_CODEQL_ACTION_SHA + } + assert all( + f"# {_EXPECTED_CODEQL_ACTION_VERSION}" in suffix + for _, _, _, suffix in references + ) + + +def test_analysis_workflow_keeps_init_autobuild_and_analyze_atomic() -> None: + """Require the analysis lifecycle to move as one immutable dependency unit.""" + workflow_path = _WORKFLOW_ROOT / "codeql.yml" + workflow_text = workflow_path.read_text(encoding="utf-8") + references = { + action_name: revision_sha + for action_name, revision_sha, _suffix in _CODEQL_ACTION_REFERENCE.findall(workflow_text) + } + + assert references == { + "init": _EXPECTED_CODEQL_ACTION_SHA, + "autobuild": _EXPECTED_CODEQL_ACTION_SHA, + "analyze": _EXPECTED_CODEQL_ACTION_SHA, + } From ec2f03051a20edabeb820ad40b7812f84f9fbba2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 16:55:55 +0900 Subject: [PATCH 02/16] style(test): format CodeQL revision contract --- .../tests/test_codeql_action_revision_contract.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/services/analysis-engine/tests/test_codeql_action_revision_contract.py b/services/analysis-engine/tests/test_codeql_action_revision_contract.py index 1f9bc2d6f..997e51326 100644 --- a/services/analysis-engine/tests/test_codeql_action_revision_contract.py +++ b/services/analysis-engine/tests/test_codeql_action_revision_contract.py @@ -19,8 +19,10 @@ def _codeql_action_references() -> list[tuple[Path, str, str, str]]: references: list[tuple[Path, str, str, str]] = [] for workflow_path in sorted(_WORKFLOW_ROOT.glob("*.y*ml")): workflow_text = workflow_path.read_text(encoding="utf-8") - for action_name, revision_sha, suffix in _CODEQL_ACTION_REFERENCE.findall(workflow_text): - references.append((workflow_path, action_name, revision_sha, suffix.strip())) + matches = _CODEQL_ACTION_REFERENCE.findall(workflow_text) + for action_name, revision_sha, suffix in matches: + reference = (workflow_path, action_name, revision_sha, suffix.strip()) + references.append(reference) return references @@ -32,10 +34,8 @@ def test_every_codeql_action_step_uses_the_same_reviewed_revision() -> None: assert {revision_sha for _, _, revision_sha, _ in references} == { _EXPECTED_CODEQL_ACTION_SHA } - assert all( - f"# {_EXPECTED_CODEQL_ACTION_VERSION}" in suffix - for _, _, _, suffix in references - ) + expected_version = f"# {_EXPECTED_CODEQL_ACTION_VERSION}" + assert all(expected_version in suffix for _, _, _, suffix in references) def test_analysis_workflow_keeps_init_autobuild_and_analyze_atomic() -> None: From c453203d132ab2216331a6ab9b7727eb7f9f7cc0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 17:04:39 +0900 Subject: [PATCH 03/16] ci: add one-shot Ruff formatter for PR 780 --- .github/workflows/repair-pr-780-format.yml | 56 ++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 .github/workflows/repair-pr-780-format.yml diff --git a/.github/workflows/repair-pr-780-format.yml b/.github/workflows/repair-pr-780-format.yml new file mode 100644 index 000000000..025e07760 --- /dev/null +++ b/.github/workflows/repair-pr-780-format.yml @@ -0,0 +1,56 @@ +name: repair-pr-780-format + +on: + push: + branches: + - fix/codeql-action-consistency-v4-37-6 + workflow_dispatch: + +permissions: + contents: write + +concurrency: + group: repair-pr-780-format + cancel-in-progress: false + +jobs: + format: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Check out the exact feature branch + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + ref: fix/codeql-action-consistency-v4-37-6 + fetch-depth: 1 + + - name: Install pinned uv + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v6.7.0 + with: + version: "0.8.6" + enable-cache: false + + - name: Format only the failing contract test + shell: bash + run: | + set -euo pipefail + uvx ruff@0.15.5 format \ + services/analysis-engine/tests/test_codeql_action_revision_contract.py + changed="$(git diff --name-only)" + test "$changed" = "services/analysis-engine/tests/test_codeql_action_revision_contract.py" + uvx ruff@0.15.5 format --check \ + services/analysis-engine/tests/test_codeql_action_revision_contract.py + + - name: Commit the formatter result and remove this one-shot workflow + shell: bash + run: | + set -euo pipefail + rm .github/workflows/repair-pr-780-format.yml + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add \ + services/analysis-engine/tests/test_codeql_action_revision_contract.py \ + .github/workflows/repair-pr-780-format.yml + git diff --cached --check + git commit -m "style(test): apply canonical Ruff formatting" + git push origin HEAD:fix/codeql-action-consistency-v4-37-6 From 1348c6d29f4f4e10a2cfb843c75fa9e3f0bde519 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 08:06:00 +0000 Subject: [PATCH 04/16] style(test): apply canonical Ruff formatting --- .github/workflows/repair-pr-780-format.yml | 56 ------------------- .../test_codeql_action_revision_contract.py | 4 +- 2 files changed, 1 insertion(+), 59 deletions(-) delete mode 100644 .github/workflows/repair-pr-780-format.yml diff --git a/.github/workflows/repair-pr-780-format.yml b/.github/workflows/repair-pr-780-format.yml deleted file mode 100644 index 025e07760..000000000 --- a/.github/workflows/repair-pr-780-format.yml +++ /dev/null @@ -1,56 +0,0 @@ -name: repair-pr-780-format - -on: - push: - branches: - - fix/codeql-action-consistency-v4-37-6 - workflow_dispatch: - -permissions: - contents: write - -concurrency: - group: repair-pr-780-format - cancel-in-progress: false - -jobs: - format: - runs-on: ubuntu-latest - timeout-minutes: 10 - steps: - - name: Check out the exact feature branch - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - with: - ref: fix/codeql-action-consistency-v4-37-6 - fetch-depth: 1 - - - name: Install pinned uv - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v6.7.0 - with: - version: "0.8.6" - enable-cache: false - - - name: Format only the failing contract test - shell: bash - run: | - set -euo pipefail - uvx ruff@0.15.5 format \ - services/analysis-engine/tests/test_codeql_action_revision_contract.py - changed="$(git diff --name-only)" - test "$changed" = "services/analysis-engine/tests/test_codeql_action_revision_contract.py" - uvx ruff@0.15.5 format --check \ - services/analysis-engine/tests/test_codeql_action_revision_contract.py - - - name: Commit the formatter result and remove this one-shot workflow - shell: bash - run: | - set -euo pipefail - rm .github/workflows/repair-pr-780-format.yml - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add \ - services/analysis-engine/tests/test_codeql_action_revision_contract.py \ - .github/workflows/repair-pr-780-format.yml - git diff --cached --check - git commit -m "style(test): apply canonical Ruff formatting" - git push origin HEAD:fix/codeql-action-consistency-v4-37-6 diff --git a/services/analysis-engine/tests/test_codeql_action_revision_contract.py b/services/analysis-engine/tests/test_codeql_action_revision_contract.py index 997e51326..8a82481c4 100644 --- a/services/analysis-engine/tests/test_codeql_action_revision_contract.py +++ b/services/analysis-engine/tests/test_codeql_action_revision_contract.py @@ -31,9 +31,7 @@ def test_every_codeql_action_step_uses_the_same_reviewed_revision() -> None: references = _codeql_action_references() assert references - assert {revision_sha for _, _, revision_sha, _ in references} == { - _EXPECTED_CODEQL_ACTION_SHA - } + assert {revision_sha for _, _, revision_sha, _ in references} == {_EXPECTED_CODEQL_ACTION_SHA} expected_version = f"# {_EXPECTED_CODEQL_ACTION_VERSION}" assert all(expected_version in suffix for _, _, _, suffix in references) From 0a6ae2b4d749d473f3b0a451bed1a6a58c876080 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 14 Aug 2026 17:10:06 +0900 Subject: [PATCH 05/16] ci: retrigger exact-head validation after canonical Ruff formatting From f4f40a160c9711a1cc05454f5306872c4f98fe5d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 15 Aug 2026 08:16:16 +0900 Subject: [PATCH 06/16] fix(security): advance atomic CodeQL revision to v4.37.7 Update every CodeQL lifecycle phase and SARIF uploader to the verified upstream v4.37.7 commit, refresh the regression contract, changelog, and doctoring, and record the v2.26.3 bundle update. Preserve immutable SHA pinning and the existing atomic-version policy. --- .github/workflows/codeql.yml | 6 +++--- .github/workflows/ossf-scorecard.yml | 2 +- .github/workflows/trivy.yml | 2 +- CHANGELOG.md | 2 +- docs/doctoring/codeql-action-atomic-revision.md | 12 +++++++----- .../tests/test_codeql_action_revision_contract.py | 4 ++-- 6 files changed, 15 insertions(+), 13 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ee9b6019a..1ea17ad12 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,8 +32,8 @@ jobs: - python steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 with: languages: ${{ matrix.language }} - - uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 - - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + - uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index a3c287789..0da083df9 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -79,6 +79,6 @@ jobs: python3 trusted-scorecard-scripts/scripts/checks/normalize_scorecard_sarif.py scorecard-sarif/results.sarif normalized-scorecard-results.sarif - - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6; immutable SHA pinning retained as supply-chain attack mitigation. + - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7; immutable SHA pinning retained as supply-chain attack mitigation. with: sarif_file: normalized-scorecard-results.sarif diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index cd417efba..9e5b97c9d 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -48,7 +48,7 @@ jobs: skip-dirs: 'services/analysis-engine/.venv' trivyignores: ./.trivyignore - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6; immutable SHA pinning retained as supply-chain attack mitigation. + uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7; immutable SHA pinning retained as supply-chain attack mitigation. if: always() with: sarif_file: trivy-results.sarif diff --git a/CHANGELOG.md b/CHANGELOG.md index 105f06d26..b7807db3a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ ### Changed -- Updated every CodeQL Action phase and SARIF uploader together to the reviewed immutable `v4.37.6` revision, with a regression contract that prevents mixed `init`, `autobuild`, `analyze`, and `upload-sarif` versions. +- Updated every CodeQL Action phase and SARIF uploader together to the reviewed immutable `v4.37.7` revision, with a regression contract that prevents mixed `init`, `autobuild`, `analyze`, and `upload-sarif` versions. ## [0.1.3] - 2026-04-29 diff --git a/docs/doctoring/codeql-action-atomic-revision.md b/docs/doctoring/codeql-action-atomic-revision.md index 61312f4fa..25fa941f8 100644 --- a/docs/doctoring/codeql-action-atomic-revision.md +++ b/docs/doctoring/codeql-action-atomic-revision.md @@ -4,7 +4,7 @@ BandScope treats the CodeQL Action lifecycle as one supply-chain dependency. Every checked-in reference to `github/codeql-action/init`, `autobuild`, `analyze`, and `upload-sarif` must use the same reviewed full-length commit SHA and matching release annotation. -The current reviewed revision is CodeQL Action `v4.37.6` at commit `5595ccaf912efad79be6eef63a5619ff05969be3`. +The current reviewed revision is CodeQL Action `v4.37.7` at commit `ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd`. The upstream release was published on August 13, 2026 and advances the default CodeQL bundle to `2.26.3`. GitHub documents `init` as the phase that initializes CodeQL, `autobuild` as the optional automatic build phase, and `analyze` as the phase that finalizes the database, runs queries, and uploads results. `upload-sarif` publishes SARIF generated by other tools. These phases exchange state and therefore move together in this repository rather than through independent dependency pull requests. @@ -33,7 +33,7 @@ The change does not alter workflow triggers, language selection, build behavior, `services/analysis-engine/tests/test_codeql_action_revision_contract.py` scans every workflow and fails unless: 1. all CodeQL Action phases use one exact reviewed SHA; -2. every reference carries the matching `v4.37.6` annotation; and +2. every reference carries the matching `v4.37.7` annotation; and 3. `codeql.yml` keeps `init`, `autobuild`, and `analyze` on that same revision. Repository CI, CodeQL, SAST, dependency/security scans, SBOM generation, central coverage evidence, automated review, independent approval, and branch protection must all validate the final exact head. Results from split predecessor pull requests are not transferable. @@ -54,8 +54,10 @@ Rollback restores the previously accepted full-length SHA across every CodeQL Ac ## References -GitHub. (2026). *CodeQL Action v4.37.6* [Software release]. https://github.com/github/codeql-action/releases/tag/v4.37.6 +GitHub. (2026). *CodeQL Action v4.37.7* [Software release]. https://github.com/github/codeql-action/releases/tag/v4.37.7 -GitHub. (n.d.). *CodeQL code scanning for compiled languages*. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages +GitHub. (2026). *CodeQL Bundle v2.26.3* [Software release]. https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3 -GitHub. (n.d.). *Secure use reference*. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/actions/reference/security/secure-use +GitHub. (n.d.). *CodeQL code scanning for compiled languages*. GitHub Docs. Retrieved August 15, 2026, from https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages + +GitHub. (n.d.). *Secure use reference*. GitHub Docs. Retrieved August 15, 2026, from https://docs.github.com/en/actions/reference/security/secure-use diff --git a/services/analysis-engine/tests/test_codeql_action_revision_contract.py b/services/analysis-engine/tests/test_codeql_action_revision_contract.py index 8a82481c4..d86d5b22a 100644 --- a/services/analysis-engine/tests/test_codeql_action_revision_contract.py +++ b/services/analysis-engine/tests/test_codeql_action_revision_contract.py @@ -7,8 +7,8 @@ _REPOSITORY_ROOT = Path(__file__).resolve().parents[3] _WORKFLOW_ROOT = _REPOSITORY_ROOT / ".github" / "workflows" -_EXPECTED_CODEQL_ACTION_SHA = "5595ccaf912efad79be6eef63a5619ff05969be3" -_EXPECTED_CODEQL_ACTION_VERSION = "v4.37.6" +_EXPECTED_CODEQL_ACTION_SHA = "ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd" +_EXPECTED_CODEQL_ACTION_VERSION = "v4.37.7" _CODEQL_ACTION_REFERENCE = re.compile( r"github/codeql-action/(init|autobuild|analyze|upload-sarif)@([0-9a-f]{40})([^\n]*)" ) From 0e57921de5e8f0ef8b66a739c3d4110709753a60 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 16 Aug 2026 07:06:41 +0900 Subject: [PATCH 07/16] test(codeql): detect mutable action references --- .../tests/test_codeql_action_revision_contract.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/services/analysis-engine/tests/test_codeql_action_revision_contract.py b/services/analysis-engine/tests/test_codeql_action_revision_contract.py index d86d5b22a..5ec75adf8 100644 --- a/services/analysis-engine/tests/test_codeql_action_revision_contract.py +++ b/services/analysis-engine/tests/test_codeql_action_revision_contract.py @@ -26,6 +26,15 @@ def _codeql_action_references() -> list[tuple[Path, str, str, str]]: return references +def test_reference_scanner_detects_non_sha_codeql_references() -> None: + """Mutable CodeQL refs must be visible to the guard instead of being skipped.""" + workflow_line = "uses: github/codeql-action/init@v4 # mutable reference" + + matches = _CODEQL_ACTION_REFERENCE.findall(workflow_line) + + assert matches == [("init", "v4", " # mutable reference")] + + def test_every_codeql_action_step_uses_the_same_reviewed_revision() -> None: """Prevent independently updated phases from creating mixed CodeQL runtimes.""" references = _codeql_action_references() From 30d92d54648976f3047b47ed86d8d43ee3407bcd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 16 Aug 2026 07:06:52 +0900 Subject: [PATCH 08/16] fix(codeql): scan mutable refs before enforcing SHA pin --- .../tests/test_codeql_action_revision_contract.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/services/analysis-engine/tests/test_codeql_action_revision_contract.py b/services/analysis-engine/tests/test_codeql_action_revision_contract.py index 5ec75adf8..9add54ae4 100644 --- a/services/analysis-engine/tests/test_codeql_action_revision_contract.py +++ b/services/analysis-engine/tests/test_codeql_action_revision_contract.py @@ -10,18 +10,18 @@ _EXPECTED_CODEQL_ACTION_SHA = "ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd" _EXPECTED_CODEQL_ACTION_VERSION = "v4.37.7" _CODEQL_ACTION_REFERENCE = re.compile( - r"github/codeql-action/(init|autobuild|analyze|upload-sarif)@([0-9a-f]{40})([^\n]*)" + r"github/codeql-action/(init|autobuild|analyze|upload-sarif)@([^\s#]+)([^\n]*)" ) def _codeql_action_references() -> list[tuple[Path, str, str, str]]: - """Return every pinned CodeQL Action reference from checked-in workflows.""" + """Return every CodeQL Action reference from checked-in workflows.""" references: list[tuple[Path, str, str, str]] = [] for workflow_path in sorted(_WORKFLOW_ROOT.glob("*.y*ml")): workflow_text = workflow_path.read_text(encoding="utf-8") matches = _CODEQL_ACTION_REFERENCE.findall(workflow_text) - for action_name, revision_sha, suffix in matches: - reference = (workflow_path, action_name, revision_sha, suffix.strip()) + for action_name, revision_ref, suffix in matches: + reference = (workflow_path, action_name, revision_ref, suffix.strip()) references.append(reference) return references @@ -40,7 +40,7 @@ def test_every_codeql_action_step_uses_the_same_reviewed_revision() -> None: references = _codeql_action_references() assert references - assert {revision_sha for _, _, revision_sha, _ in references} == {_EXPECTED_CODEQL_ACTION_SHA} + assert {revision_ref for _, _, revision_ref, _ in references} == {_EXPECTED_CODEQL_ACTION_SHA} expected_version = f"# {_EXPECTED_CODEQL_ACTION_VERSION}" assert all(expected_version in suffix for _, _, _, suffix in references) @@ -50,8 +50,8 @@ def test_analysis_workflow_keeps_init_autobuild_and_analyze_atomic() -> None: workflow_path = _WORKFLOW_ROOT / "codeql.yml" workflow_text = workflow_path.read_text(encoding="utf-8") references = { - action_name: revision_sha - for action_name, revision_sha, _suffix in _CODEQL_ACTION_REFERENCE.findall(workflow_text) + action_name: revision_ref + for action_name, revision_ref, _suffix in _CODEQL_ACTION_REFERENCE.findall(workflow_text) } assert references == { From 738495ca9d425fb34a12e76c0614eda356e68f3a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 16 Aug 2026 07:07:07 +0900 Subject: [PATCH 09/16] docs(codeql): document mutable-ref detection --- docs/doctoring/codeql-action-atomic-revision.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/doctoring/codeql-action-atomic-revision.md b/docs/doctoring/codeql-action-atomic-revision.md index 25fa941f8..dba5e8e5f 100644 --- a/docs/doctoring/codeql-action-atomic-revision.md +++ b/docs/doctoring/codeql-action-atomic-revision.md @@ -36,6 +36,8 @@ The change does not alter workflow triggers, language selection, build behavior, 2. every reference carries the matching `v4.37.7` annotation; and 3. `codeql.yml` keeps `init`, `autobuild`, and `analyze` on that same revision. +The scanner intentionally recognizes mutable and malformed revision tokens such as `@v4` before enforcing the exact-SHA invariant. A tag-style reference therefore becomes a failing value instead of disappearing from the evidence set because it did not already look like a 40-character SHA. + Repository CI, CodeQL, SAST, dependency/security scans, SBOM generation, central coverage evidence, automated review, independent approval, and branch protection must all validate the final exact head. Results from split predecessor pull requests are not transferable. ## Update procedure From c43bf95bc0cb0fff952c3ef46bcb15c31fd4bed5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 11:15:21 -0700 Subject: [PATCH 10/16] test(codeql): require atomic v4.37.8 revision --- .../tests/test_codeql_action_revision_contract.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/services/analysis-engine/tests/test_codeql_action_revision_contract.py b/services/analysis-engine/tests/test_codeql_action_revision_contract.py index 9add54ae4..cdca297df 100644 --- a/services/analysis-engine/tests/test_codeql_action_revision_contract.py +++ b/services/analysis-engine/tests/test_codeql_action_revision_contract.py @@ -7,8 +7,8 @@ _REPOSITORY_ROOT = Path(__file__).resolve().parents[3] _WORKFLOW_ROOT = _REPOSITORY_ROOT / ".github" / "workflows" -_EXPECTED_CODEQL_ACTION_SHA = "ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd" -_EXPECTED_CODEQL_ACTION_VERSION = "v4.37.7" +_EXPECTED_CODEQL_ACTION_SHA = "db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28" +_EXPECTED_CODEQL_ACTION_VERSION = "v4.37.8" _CODEQL_ACTION_REFERENCE = re.compile( r"github/codeql-action/(init|autobuild|analyze|upload-sarif)@([^\s#]+)([^\n]*)" ) @@ -58,4 +58,4 @@ def test_analysis_workflow_keeps_init_autobuild_and_analyze_atomic() -> None: "init": _EXPECTED_CODEQL_ACTION_SHA, "autobuild": _EXPECTED_CODEQL_ACTION_SHA, "analyze": _EXPECTED_CODEQL_ACTION_SHA, - } + } \ No newline at end of file From 695546852e4e56c191171ffd6a044f196d34fbfd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 11:15:48 -0700 Subject: [PATCH 11/16] build(codeql): advance analysis phases to v4.37.8 --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1ea17ad12..8440aad8d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,8 +32,8 @@ jobs: - python steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 with: languages: ${{ matrix.language }} - - uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 - - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 + - uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 \ No newline at end of file From 81bcc60fa64a306f628225f98ed7c836b36bbdbd Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 11:16:24 -0700 Subject: [PATCH 12/16] build(codeql): advance Scorecard upload to v4.37.8 --- .github/workflows/ossf-scorecard.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index 0da083df9..9ec1220d1 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -79,6 +79,6 @@ jobs: python3 trusted-scorecard-scripts/scripts/checks/normalize_scorecard_sarif.py scorecard-sarif/results.sarif normalized-scorecard-results.sarif - - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7; immutable SHA pinning retained as supply-chain attack mitigation. + - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8; immutable SHA pinning retained as supply-chain attack mitigation. with: - sarif_file: normalized-scorecard-results.sarif + sarif_file: normalized-scorecard-results.sarif \ No newline at end of file From 708cb3d33f21547ec6f2611b4b643e94759df21f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 11:16:47 -0700 Subject: [PATCH 13/16] build(codeql): advance Trivy SARIF upload to v4.37.8 --- .github/workflows/trivy.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 9e5b97c9d..33044efb5 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -48,7 +48,7 @@ jobs: skip-dirs: 'services/analysis-engine/.venv' trivyignores: ./.trivyignore - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7; immutable SHA pinning retained as supply-chain attack mitigation. + uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8; immutable SHA pinning retained as supply-chain attack mitigation. if: always() with: - sarif_file: trivy-results.sarif + sarif_file: trivy-results.sarif \ No newline at end of file From b07c0cad4a8e405d82cb5f51c229030897fae80a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 11:17:42 -0700 Subject: [PATCH 14/16] docs(codeql): record v4.37.8 atomic revision --- docs/doctoring/codeql-action-atomic-revision.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/doctoring/codeql-action-atomic-revision.md b/docs/doctoring/codeql-action-atomic-revision.md index dba5e8e5f..9ce557a3c 100644 --- a/docs/doctoring/codeql-action-atomic-revision.md +++ b/docs/doctoring/codeql-action-atomic-revision.md @@ -4,7 +4,7 @@ BandScope treats the CodeQL Action lifecycle as one supply-chain dependency. Every checked-in reference to `github/codeql-action/init`, `autobuild`, `analyze`, and `upload-sarif` must use the same reviewed full-length commit SHA and matching release annotation. -The current reviewed revision is CodeQL Action `v4.37.7` at commit `ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd`. The upstream release was published on August 13, 2026 and advances the default CodeQL bundle to `2.26.3`. +The current reviewed revision is CodeQL Action `v4.37.8` at commit `db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28`. The upstream annotated tag object `37f2634a92ba38a0926ef79a0748ac8ae7d95ab2` resolves to that commit. The release was published on August 21, 2026 and reports no user-facing changes; it retains the v4.37.7-era default CodeQL bundle `2.26.3`. GitHub documents `init` as the phase that initializes CodeQL, `autobuild` as the optional automatic build phase, and `analyze` as the phase that finalizes the database, runs queries, and uploads results. `upload-sarif` publishes SARIF generated by other tools. These phases exchange state and therefore move together in this repository rather than through independent dependency pull requests. @@ -33,7 +33,7 @@ The change does not alter workflow triggers, language selection, build behavior, `services/analysis-engine/tests/test_codeql_action_revision_contract.py` scans every workflow and fails unless: 1. all CodeQL Action phases use one exact reviewed SHA; -2. every reference carries the matching `v4.37.7` annotation; and +2. every reference carries the matching `v4.37.8` annotation; and 3. `codeql.yml` keeps `init`, `autobuild`, and `analyze` on that same revision. The scanner intentionally recognizes mutable and malformed revision tokens such as `@v4` before enforcing the exact-SHA invariant. A tag-style reference therefore becomes a failing value instead of disappearing from the evidence set because it did not already look like a 40-character SHA. @@ -56,10 +56,10 @@ Rollback restores the previously accepted full-length SHA across every CodeQL Ac ## References -GitHub. (2026). *CodeQL Action v4.37.7* [Software release]. https://github.com/github/codeql-action/releases/tag/v4.37.7 +GitHub. (2026). *CodeQL Action v4.37.8* [Software release]. https://github.com/github/codeql-action/releases/tag/v4.37.8 GitHub. (2026). *CodeQL Bundle v2.26.3* [Software release]. https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3 -GitHub. (n.d.). *CodeQL code scanning for compiled languages*. GitHub Docs. Retrieved August 15, 2026, from https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages +GitHub. (n.d.). *CodeQL code scanning for compiled languages*. GitHub Docs. Retrieved August 25, 2026, from https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/codeql-for-compiled-languages -GitHub. (n.d.). *Secure use reference*. GitHub Docs. Retrieved August 15, 2026, from https://docs.github.com/en/actions/reference/security/secure-use +GitHub. (n.d.). *Secure use reference*. GitHub Docs. Retrieved August 25, 2026, from https://docs.github.com/en/actions/reference/security/secure-use \ No newline at end of file From b860c4960083d3abf0ffe2682b2a75f0418f42c0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 11:18:39 -0700 Subject: [PATCH 15/16] docs(changelog): record CodeQL v4.37.8 --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b7807db3a..a2121acea 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ ### Changed -- Updated every CodeQL Action phase and SARIF uploader together to the reviewed immutable `v4.37.7` revision, with a regression contract that prevents mixed `init`, `autobuild`, `analyze`, and `upload-sarif` versions. +- Updated every CodeQL Action phase and SARIF uploader together to the reviewed immutable `v4.37.8` revision, with a regression contract that prevents mixed `init`, `autobuild`, `analyze`, and `upload-sarif` versions. ## [0.1.3] - 2026-04-29 @@ -69,4 +69,4 @@ - `ChordsFeature` (코드 분석) 화면에서 각 파트(Role)의 `transpositionPlan`(이조/조옮김 계획)을 표시하는 기능을 추가했습니다. - `RangesFeature` (음역대 분석) 화면에서 겹침 경고(Overlap warning) 외에 해당 파트의 채보(Transcription) 가능 노드 수를 요약하여 보여주는 기능을 추가했습니다. -- 신규 UI 요소에 대한 100% 테스트 커버리지를 보장하는 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`). +- 신규 UI 요소에 대한 100% 테스트 커버리지를 보장하는 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`). \ No newline at end of file From d9b8e97fa00f2e0e34e15654a3d5ffa6e34ab75b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 25 Aug 2026 12:38:31 -0700 Subject: [PATCH 16/16] test(codeql): format revision contract --- .../tests/test_codeql_action_revision_contract.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/services/analysis-engine/tests/test_codeql_action_revision_contract.py b/services/analysis-engine/tests/test_codeql_action_revision_contract.py index cdca297df..03d26b369 100644 --- a/services/analysis-engine/tests/test_codeql_action_revision_contract.py +++ b/services/analysis-engine/tests/test_codeql_action_revision_contract.py @@ -40,7 +40,9 @@ def test_every_codeql_action_step_uses_the_same_reviewed_revision() -> None: references = _codeql_action_references() assert references - assert {revision_ref for _, _, revision_ref, _ in references} == {_EXPECTED_CODEQL_ACTION_SHA} + assert { + revision_ref for _, _, revision_ref, _ in references + } == {_EXPECTED_CODEQL_ACTION_SHA} expected_version = f"# {_EXPECTED_CODEQL_ACTION_VERSION}" assert all(expected_version in suffix for _, _, _, suffix in references)