Scan the one executable file on the site, and add the rest - #1
Merged
Conversation
assets/site.js is 3 KB with no dependencies and no build step - exactly the kind of file that quietly accumulates an innerHTML assignment nobody reviews, because there is no review surface around it. Dependabot watches actions and nothing else. There is no package manifest here, and adding one to give it something to do would undo the property check_site.py exists to enforce: the site makes no third-party requests. The aggregate CI job looks redundant with one job. That is the point - a second job added later is covered without anyone remembering to edit the branch protection rule.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
The site had
check_site.pyand a weekly outbound-link check, and nothing else.codeql.yml: JavaScript, weekly and on every pushdependabot.yml: actions onlydependabot-auto-merge.ymlCIjobcheckoutandsetup-pythonto current majorsWhy
assets/site.jsis 3 KB with no dependencies and no build step — exactly thekind of file that quietly accumulates an
innerHTMLassignment nobody reviews,because there is no review surface around it. That is what the default query
pack is good at finding.
Dependabot watches actions and nothing else. There is no package manifest here,
and adding one to give it something to do would undo the property
check_site.pyexists to enforce: the site makes no third-party requests.The aggregate
CIjob looks redundant with one job. That is the point — asecond job added later is covered without anyone remembering to edit the branch
protection rule.
What breaks if this is wrong
Nothing a visitor sees. The CodeQL job is the only new thing that can fail, and
it fails loudly rather than silently: this repository is public, so it needs no
visibility guard, unlike the Python ones.
Checklist