From 37ddcf21ace64f064ce99e8342a3ebf2b9587d80 Mon Sep 17 00:00:00 2001 From: Mehdi Bouaziz Date: Wed, 27 May 2026 15:51:57 +0000 Subject: [PATCH 1/3] ci(codeql): add actions language Enables CodeQL scanning of GitHub Actions workflow files. Catches script-injection via untrusted inputs in run blocks, missing permissions, and similar security issues in CI definitions. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8a8026c1c..3d4bcfd61 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -27,6 +27,8 @@ jobs: build-mode: manual - language: java-kotlin build-mode: manual + - language: actions + build-mode: none steps: - name: Checkout repository uses: actions/checkout@v4 From d0de471be1698e9b7c9f6cdb2e1850a564716cdd Mon Sep 17 00:00:00 2001 From: Mehdi Bouaziz Date: Wed, 27 May 2026 15:52:18 +0000 Subject: [PATCH 2/3] ci(codeql): use security-extended query suite MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The default query suite focuses on high-precision findings. The security-extended suite adds queries with lower precision that still turn up real issues — broader coverage at the cost of more triage work. Easy to revert per-language via a matrix field if any one language becomes too noisy. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3d4bcfd61..a7bbc7c40 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -65,6 +65,7 @@ jobs: with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} + queries: security-extended - name: Build C runtime (manual c-cpp) if: matrix.language == 'c-cpp' From f39e69aab3aa5d21f27e0f564a111cc41ccf3aec Mon Sep 17 00:00:00 2001 From: Mehdi Bouaziz Date: Wed, 27 May 2026 15:52:51 +0000 Subject: [PATCH 3/3] ci: add actionlint workflow actionlint catches GitHub Actions issues that CodeQL doesn't: deprecated syntax, typos in event/job/step keys, shellcheck on run: blocks, glob/regex mistakes in paths filters, etc. Complements the security-focused CodeQL actions extractor. Triggers only on changes under .github/workflows/, so it's near-free when the rest of the tree changes. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/actionlint.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/actionlint.yml diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml new file mode 100644 index 000000000..20152dc0a --- /dev/null +++ b/.github/workflows/actionlint.yml @@ -0,0 +1,26 @@ +name: actionlint + +on: + workflow_dispatch: + pull_request: + paths: + - '.github/workflows/**' + push: + branches: [main] + paths: + - '.github/workflows/**' + +permissions: + contents: read + +jobs: + actionlint: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Install and run actionlint + shell: bash + run: | + bash <(curl --proto '=https' --tlsv1.2 -sSf \ + https://raw.githubusercontent.com/rhysd/actionlint/v1.7.7/scripts/download-actionlint.bash) + ./actionlint -color