mirror of
https://github.com/only-cli/oc.git
synced 2026-09-15 10:40:56 +02:00
only-cli
bbe894bb96
Every GitHub action is now pinned to a full commit SHA with its version in a trailing comment, verified against each upstream repo's tags, so a retagged release cannot swap code under CI. The publish workflow pins npm to an exact version instead of @latest, the experiment Dockerfile pins its base image by digest, and codeql.yml gets a top-level read-all permissions block so the default token grants nothing the analyze job does not ask for. SECURITY.md points reports at GitHub private vulnerability reporting, which is now enabled, and scopes out experiments/. Branch protection on main now blocks force pushes and deletions.
35 lines
917 B
YAML
35 lines
917 B
YAML
# Static analysis for the JS source, on every push/PR plus a weekly scan
|
|
# that catches newly-disclosed vulnerable patterns in unchanged code.
|
|
name: "CodeQL"
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: "17 3 * * 1"
|
|
|
|
# The analyze job widens its own permissions; everything else gets none.
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
security-events: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
|
|
with:
|
|
languages: javascript-typescript
|
|
|
|
- uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
|
|
with:
|
|
category: "/language:javascript-typescript"
|