Jakob Wennberg
5369349e9e
Unblocks docker-image-scan (red 5 runs straight on GHSA-f88m-g3jw-g9cj: next's nested sharp@0.34.5, deduped via an override). Finishes the #1218 Sonnet 5 rollout: compliance-pr and compliance-swarm were falling through to compliancemaxx's sonnet-4-6 default; swedish-compliance-review.mjs budgeted max_tokens as if thinking were off (it is adaptive-by-default on Sonnet 5) and never checked stop_reason; pr-agent's token budgets were sized for 4.6's tokenizer and its hidden default OpenAI fallback list is now emptied explicitly. Core build 7m43s -> 2m51s measured (parallel checks/build/test, unit suite sharded 4 ways). Docker publish moves off QEMU to native ARM runners with a digest-merge job, so tags apply only on success and latest never moves on failure. 40 actions pinned to immutable SHAs; adds zizmor (0 high after fixing persist-credentials on 7 checkouts and permissions on test-pg-real) and CodeQL (0 findings on first run). Full details in the PR body.
72 lines
2.5 KiB
YAML
72 lines
2.5 KiB
YAML
name: CodeQL
|
|
|
|
# Semantic code scanning. The repo already had `security-events: write` and
|
|
# uploaded Trivy SARIF, but Trivy only reports known CVEs in dependencies and
|
|
# base images: nothing analysed the application's own code. For a multi-tenant
|
|
# accounting SaaS holding personnummer, bank data and money, that was the gap.
|
|
#
|
|
# Two languages:
|
|
# javascript-typescript - the app itself (injection, path traversal, unsafe
|
|
# deserialization, missing authorization checks, hardcoded credentials).
|
|
# actions - GitHub's own workflow analysis. It overlaps zizmor.yml without
|
|
# replacing it: CodeQL follows dataflow into composite actions, zizmor knows
|
|
# Actions-specific misconfigurations CodeQL has no notion of. Two cheap
|
|
# scanners with different blind spots beat one.
|
|
#
|
|
# The default query suite is used deliberately. `security-extended` finds more
|
|
# but roughly doubles the runtime, and this already runs on every PR; revisit
|
|
# once the default suite's findings are triaged.
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
# Weekly. CodeQL ships new queries continuously, so an unchanged repo can
|
|
# still acquire findings.
|
|
- cron: '19 3 * * 1'
|
|
workflow_dispatch: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: read
|
|
# Required to upload the analysis results.
|
|
security-events: write
|
|
# Required by the `actions` language pack to read workflow metadata.
|
|
actions: read
|
|
strategy:
|
|
# A failure in one language should not hide the other's results.
|
|
fail-fast: false
|
|
matrix:
|
|
language: [javascript-typescript, actions]
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
|
|
# No build step. javascript-typescript and actions are both interpreted
|
|
# languages to CodeQL, extracted straight from source, so `npm ci` and
|
|
# `next build` would add minutes and change nothing about the database.
|
|
- name: Perform CodeQL analysis
|
|
uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
|
|
with:
|
|
category: /language:${{ matrix.language }}
|