From 62a1169913ea3cff13a67b888e9c486edbb8effa Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:37:58 -0400 Subject: [PATCH 1/7] ci: add enterprise automation baseline --- .github/workflows/codeql.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..44228ac --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,15 @@ +name: CodeQL +on: + push: + pull_request: + schedule: [{cron: '23 3 * * 1'}] +permissions: {contents: read, security-events: write} +jobs: + analyze: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: github/codeql-action/init@v3 + with: {languages: python, javascript-typescript, go, rust, java-kotlin, c-cpp} + - uses: github/codeql-action/autobuild@v3 + - uses: github/codeql-action/analyze@v3 From 530dd106d288346255460e20df4811a9164d9021 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:38:37 -0400 Subject: [PATCH 2/7] ci: add enterprise automation baseline --- .github/workflows/dependency-review.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..52a13f9 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,9 @@ +name: Dependency Review +on: {pull_request:} +permissions: {contents: read, pull-requests: read} +jobs: + review: + runs-on: ubuntu-latest + steps: + - uses: actions/dependency-review-action@v4 + with: {fail-on-severity: high} From fa58da88b1fb58df3a4df64a4f063095eea82b24 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:38:39 -0400 Subject: [PATCH 3/7] ci: add enterprise automation baseline --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..aac8031 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: {interval: weekly} + open-pull-requests-limit: 10 From d1ed005b0f161cab243ee2d15b7008170406ecb8 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 20:07:44 -0400 Subject: [PATCH 4/7] ci: validate CodeQL language YAML --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 44228ac..ad868d5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,6 +10,6 @@ jobs: steps: - uses: actions/checkout@v4 - uses: github/codeql-action/init@v3 - with: {languages: python, javascript-typescript, go, rust, java-kotlin, c-cpp} + with: {languages: 'python,javascript-typescript,go,rust,java-kotlin,c-cpp'} - uses: github/codeql-action/autobuild@v3 - uses: github/codeql-action/analyze@v3 From b580bfc5b1206539481920a10bf2bb3367ad7d0d Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:18:44 -0400 Subject: [PATCH 5/7] ci: detect CodeQL languages per repository --- .github/workflows/codeql.yml | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ad868d5..e1525a4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,14 +2,43 @@ name: CodeQL on: push: pull_request: - schedule: [{cron: '23 3 * * 1'}] -permissions: {contents: read, security-events: write} + schedule: + - cron: '23 3 * * 1' +permissions: + contents: read + security-events: write jobs: + detect: + runs-on: ubuntu-latest + outputs: + languages: ${{ steps.lang.outputs.languages }} + steps: + - uses: actions/checkout@v4 + - id: lang + shell: bash + run: | + langs='' + find . -name '*.py' -print -quit | grep -q . && langs="$langs python" + find . ( -name '*.js' -o -name '*.ts' -o -name '*.tsx' ) -print -quit | grep -q . && langs="$langs javascript-typescript" + [ -f go.mod ] && langs="$langs go" + [ -f Cargo.toml ] && langs="$langs rust" + [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" + find . ( -name '*.c' -o -name '*.cpp' -o -name '*.h' ) -print -quit | grep -q . && langs="$langs c-cpp" + [ -n "$langs" ] || langs=' python' + langs="${langs# }" + echo "languages=$(printf '%s +' $langs | jq -Rsc 'split("\n")[:-1]')" >> "$GITHUB_OUTPUT" analyze: + needs: detect + strategy: + fail-fast: false + matrix: + language: ${{ fromJSON(needs.detect.outputs.languages) }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: github/codeql-action/init@v3 - with: {languages: 'python,javascript-typescript,go,rust,java-kotlin,c-cpp'} + with: + languages: ${{ matrix.language }} - uses: github/codeql-action/autobuild@v3 - uses: github/codeql-action/analyze@v3 From 1e776e448186a238393645d63f56dda801e8010e Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:23:36 -0400 Subject: [PATCH 6/7] ci: harden CodeQL language detection --- .github/workflows/codeql.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e1525a4..b3f48b1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -17,17 +17,18 @@ jobs: - id: lang shell: bash run: | + set -euo pipefail langs='' - find . -name '*.py' -print -quit | grep -q . && langs="$langs python" - find . ( -name '*.js' -o -name '*.ts' -o -name '*.tsx' ) -print -quit | grep -q . && langs="$langs javascript-typescript" + [ -n "$(find . -name '*.py' -print -quit)" ] && langs="$langs python" + [ -n "$(find . -name '*.js' -print -quit)" ] || [ -n "$(find . -name '*.ts' -print -quit)" ] && langs="$langs javascript-typescript" [ -f go.mod ] && langs="$langs go" [ -f Cargo.toml ] && langs="$langs rust" [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" - find . ( -name '*.c' -o -name '*.cpp' -o -name '*.h' ) -print -quit | grep -q . && langs="$langs c-cpp" + [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp" [ -n "$langs" ] || langs=' python' - langs="${langs# }" - echo "languages=$(printf '%s -' $langs | jq -Rsc 'split("\n")[:-1]')" >> "$GITHUB_OUTPUT" + json="$(printf '%s\n' $langs | jq -Rsc 'split(" +") | map(select(length > 0))')" + echo "languages=$json" >> "$GITHUB_OUTPUT" analyze: needs: detect strategy: From 45279cab1b5d9ed8662d96de2bfd2914fd462e73 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:36:40 -0400 Subject: [PATCH 7/7] ci: fix CodeQL language JSON generation --- .github/workflows/codeql.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b3f48b1..f6a1ed3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,8 +26,7 @@ jobs: [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp" [ -n "$langs" ] || langs=' python' - json="$(printf '%s\n' $langs | jq -Rsc 'split(" -") | map(select(length > 0))')" + json="$(jq -cn --arg l "$langs" '$l | split(" ") | map(select(length > 0))')" echo "languages=$json" >> "$GITHUB_OUTPUT" analyze: needs: detect