diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 9b36a5c..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: CodeQL (reusable) - -# GitHub's native semantic code analysis. Finds real bugs and security issues -# in JavaScript/TypeScript, Python, Go, Java, C/C++, Ruby, Swift, and more. -# Free for public repos. Results show in the repo's Security tab. -# -# This wrapper pins the action versions and sets the standard query suite. -# Consumers pick the language(s) and trigger frequency. - -on: - workflow_call: - inputs: - languages: - description: 'JSON array of CodeQL languages, e.g. `["javascript-typescript","python"]`. Valid values: actions, c-cpp, csharp, go, java-kotlin, javascript-typescript, python, ruby, rust, swift.' - type: string - required: true - queries: - description: "CodeQL query suite. `default` (security-and-quality light), `security-extended`, or `security-and-quality`." - type: string - default: "security-and-quality" - build-mode: - description: "Build mode: `none` (interpreted languages), `autobuild`, or `manual`. Most repos want `none`." - type: string - default: "none" - paths-ignore: - description: "Newline-separated paths to exclude from scanning." - type: string - default: | - **/__tests__/** - **/*.test.* - **/*.spec.* - dist/** - build/** - node_modules/** - -jobs: - analyze: - name: Analyze (${{ matrix.language }}) - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - strategy: - fail-fast: false - matrix: - language: ${{ fromJSON(inputs.languages) }} - - steps: - - uses: actions/checkout@v4 - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: ${{ matrix.language }} - queries: ${{ inputs.queries }} - build-mode: ${{ inputs.build-mode }} - paths-ignore: ${{ inputs.paths-ignore }} - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:${{ matrix.language }}" diff --git a/HANDOFF.md b/HANDOFF.md index 2833ce4..e65923f 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -21,10 +21,10 @@ Local working trees: `C:\github\.github\`, `C:\github\github-workflows\`, `C:\gi ## What ships today -### Reusable workflows (15) +### Reusable workflows (14) **PR contract & hygiene:** `pr-policy`, `pr-body-autoinject`, `semantic-pr-title`, `branch-naming`, `changelog-fragment`, `labeler` -**Security & dependencies:** `codeql`, `dependency-review`, `auto-merge-dependabot` +**Security & dependencies:** `dependency-review`, `auto-merge-dependabot` **Generic CI:** `node-ci`, `python-ci` **Agent workflow:** `anomaly-triage` **Repo hygiene:** `stale`, `lock-threads`, `anomaly-to-issue` @@ -48,14 +48,12 @@ Ranked by likely value: 3. **`markdown-lint.yml`** + **`link-check.yml`** reusable workflows for docs-heavy repos. Low priority unless you have a wiki. 4. **Wire pigafetta to consume `@v1`** — pigafetta still has its own inline copies of `pr-policy`, `pr-body-autoinject`, `changelog-fragment`, `anomaly-to-issue`, `labeler` in `.github/workflows/`. Replacing each with a thin caller to `@v1` would prove the loop and reduce duplication. Do this in a single PR on pigafetta, not here. 5. **Lock GitHub Actions versions** — `dependabot.yml` in `repo-template` already pins the github-actions ecosystem; on this repo we use floating refs like `actions/checkout@v4`. If you want SHA-pinning, add a Dependabot config here too — but that's a noise/safety tradeoff for a hobby account. -6. **`codeql.yml` for github-workflows itself** — these JS-in-YAML scripts deserve scanning. Wire a caller in this repo. -7. **Template repo follow-ups** — add commented-out node-ci and python-ci callers behind clear "uncomment for X stack" markers. Today the user must copy from `examples/` after cloning. Optional convenience. -8. **`branch-naming.yml` regex polish** — the default regex was tested by inspection only. Worth running it against a sample of historical branch names if you find one that should match but doesn't. +6. **Template repo follow-ups** — add commented-out node-ci and python-ci callers behind clear "uncomment for X stack" markers. Today the user must copy from `examples/` after cloning. Optional convenience. +7. **`branch-naming.yml` regex polish** — the default regex was tested by inspection only. Worth running it against a sample of historical branch names if you find one that should match but doesn't. ## Known gaps / things to verify in the wild - **`auto-merge-dependabot.yml`** has not been observed running. It uses `dependabot/fetch-metadata@v2` then `gh pr merge --auto`. First time a Dependabot PR lands in a consumer repo, verify the gate works end-to-end and that `gh pr merge --auto` succeeds with `GITHUB_TOKEN` (might need `permissions: contents: write`, which the workflow already sets). -- **`codeql.yml` matrix** uses `fromJSON(inputs.languages)` against a JSON array string. Tested by inspection; worth a real run on a consumer repo to confirm the matrix expands correctly. - **`semantic-pr-title.yml` `pull_request_target`** — be aware that `pull_request_target` runs against the base branch, which is what we want for fork PRs but means a malicious fork can't inject code here (we only read PR metadata). Don't loosen permissions in this workflow. - **`pr-body-autoinject.yml`** runs only on `opened`. If a bot edits the body later (Copilot sometimes does), the stub stays put and `pr-policy` keeps passing — that's intended. - The `STARTER.md` "Mode 1 vs Mode 2" CHANGELOG decision is documented but not enforced by tooling. A consumer in Mode 1 who accidentally wires `changelog-fragment.yml` will fail every PR. Worth a "what mode are you in?" comment at the top of the example caller someday. @@ -88,7 +86,7 @@ node /c/github/github-workflows/scripts/setup-repo.mjs ArchonVII/ --solo | `pr-policy`, `pr-body-autoinject`, `changelog-fragment`, `anomaly-to-issue`, `labeler` | Battle-tested on pigafetta (these are extractions of working workflows) | | `setup-repo.mjs` labels API path | Inspection — Octokit-equivalent calls, exact same as GitHub's docs | | `stale`, `lock-threads`, `semantic-pr-title` | Inspection — thin wrappers around mature first/third-party actions | -| `codeql`, `dependency-review` | Inspection — GitHub-first-party actions | +| `dependency-review` | Inspection — GitHub-first-party actions | | `auto-merge-dependabot` | Inspection — will exercise on first real Dependabot PR | | `node-ci`, `python-ci` | Inspection — manager detection logic should work; verify on first consumer | | `branch-naming` | Inspection — default regex covers the documented conventions | diff --git a/README.md b/README.md index e204534..31c11e7 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,6 @@ Companion repos: | Workflow | Purpose | Example | | -------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -| [`codeql.yml`](.github/workflows/codeql.yml) | GitHub's native semantic code analysis. JS/TS, Python, Go, Java, C/C++, Ruby, Swift, Rust. Results land in the repo's Security tab. | [`examples/codeql.yml`](examples/codeql.yml) | | [`dependency-review.yml`](.github/workflows/dependency-review.yml) | Block PRs that introduce vulnerable or copyleft-licensed dependencies. Operates on the lockfile diff. | [`examples/dependency-review.yml`](examples/dependency-review.yml) | | [`auto-merge-dependabot.yml`](.github/workflows/auto-merge-dependabot.yml) | Auto-merge Dependabot PRs that match the allowed update types (default: patch + minor) and pass CI. | [`examples/auto-merge-dependabot.yml`](examples/auto-merge-dependabot.yml) | diff --git a/examples/codeql.yml b/examples/codeql.yml deleted file mode 100644 index 8e672f0..0000000 --- a/examples/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# Copy to `.github/workflows/codeql.yml`. Pick languages for your repo. - -name: CodeQL - -on: - schedule: - # Weekly Sunday 06:00 UTC re-scan even when no PRs land. - - cron: '0 6 * * 0' - workflow_dispatch: - -permissions: - actions: read - contents: read - security-events: write - -jobs: - analyze: - uses: ArchonVII/github-workflows/.github/workflows/codeql.yml@v1 - with: - # JSON array — valid: actions, c-cpp, csharp, go, java-kotlin, - # javascript-typescript, python, ruby, rust, swift. - languages: '["javascript-typescript"]' - queries: 'security-and-quality'