From 8f5417a386fead3909bc704c1abf20223f1e0091 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:37:52 -0400 Subject: [PATCH 1/5] ci: add enterprise automation baseline --- .github/workflows/security.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..1e0dcaa --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,18 @@ +name: Security +on: + push: + pull_request: + schedule: [{cron: '41 4 * * 1'}] +permissions: {contents: read, security-events: write} +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: {fetch-depth: 0} + - uses: gitleaks/gitleaks-action@v2 + - uses: aquasecurity/trivy-action@master + with: {scan-type: fs, scan-ref: ., format: sarif, output: trivy-results.sarif, ignore-unfixed: true, severity: HIGH,CRITICAL, exit-code: '1'} + - uses: github/codeql-action/upload-sarif@v3 + if: always() + with: {sarif_file: trivy-results.sarif} From 0b35c3d70e4029575f0214a94b2a1d0e240614b2 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:38:19 -0400 Subject: [PATCH 2/5] ci: add enterprise automation baseline --- .github/workflows/dependency-review.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..52a13f9 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,9 @@ +name: Dependency Review +on: {pull_request:} +permissions: {contents: read, pull-requests: read} +jobs: + review: + runs-on: ubuntu-latest + steps: + - uses: actions/dependency-review-action@v4 + with: {fail-on-severity: high} From d1928337e7c2826cfa888991abd4e49e76689463 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:18:58 -0400 Subject: [PATCH 3/5] ci: detect CodeQL languages per repository --- .github/workflows/codeql.yml | 41 +++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 10 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c8a6d55..e1525a4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,23 +1,44 @@ name: CodeQL - on: push: - branches: [main] pull_request: - branches: [main] schedule: - - cron: "17 6 * * 1" - + - cron: '23 3 * * 1' permissions: contents: read security-events: write - jobs: + detect: + runs-on: ubuntu-latest + outputs: + languages: ${{ steps.lang.outputs.languages }} + steps: + - uses: actions/checkout@v4 + - id: lang + shell: bash + run: | + langs='' + find . -name '*.py' -print -quit | grep -q . && langs="$langs python" + find . ( -name '*.js' -o -name '*.ts' -o -name '*.tsx' ) -print -quit | grep -q . && langs="$langs javascript-typescript" + [ -f go.mod ] && langs="$langs go" + [ -f Cargo.toml ] && langs="$langs rust" + [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" + find . ( -name '*.c' -o -name '*.cpp' -o -name '*.h' ) -print -quit | grep -q . && langs="$langs c-cpp" + [ -n "$langs" ] || langs=' python' + langs="${langs# }" + echo "languages=$(printf '%s +' $langs | jq -Rsc 'split("\n")[:-1]')" >> "$GITHUB_OUTPUT" analyze: + needs: detect + strategy: + fail-fast: false + matrix: + language: ${{ fromJSON(needs.detect.outputs.languages) }} runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: github/codeql-action/init@v4 + - uses: actions/checkout@v4 + - uses: github/codeql-action/init@v3 with: - languages: python - - uses: github/codeql-action/analyze@v4 + languages: ${{ matrix.language }} + - uses: github/codeql-action/autobuild@v3 + - uses: github/codeql-action/analyze@v3 From d1d6303c08f89e1d990d8901cd734b9d879090f4 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:23:50 -0400 Subject: [PATCH 4/5] ci: harden CodeQL language detection --- .github/workflows/codeql.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e1525a4..b3f48b1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -17,17 +17,18 @@ jobs: - id: lang shell: bash run: | + set -euo pipefail langs='' - find . -name '*.py' -print -quit | grep -q . && langs="$langs python" - find . ( -name '*.js' -o -name '*.ts' -o -name '*.tsx' ) -print -quit | grep -q . && langs="$langs javascript-typescript" + [ -n "$(find . -name '*.py' -print -quit)" ] && langs="$langs python" + [ -n "$(find . -name '*.js' -print -quit)" ] || [ -n "$(find . -name '*.ts' -print -quit)" ] && langs="$langs javascript-typescript" [ -f go.mod ] && langs="$langs go" [ -f Cargo.toml ] && langs="$langs rust" [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" - find . ( -name '*.c' -o -name '*.cpp' -o -name '*.h' ) -print -quit | grep -q . && langs="$langs c-cpp" + [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp" [ -n "$langs" ] || langs=' python' - langs="${langs# }" - echo "languages=$(printf '%s -' $langs | jq -Rsc 'split("\n")[:-1]')" >> "$GITHUB_OUTPUT" + json="$(printf '%s\n' $langs | jq -Rsc 'split(" +") | map(select(length > 0))')" + echo "languages=$json" >> "$GITHUB_OUTPUT" analyze: needs: detect strategy: From b38bde85ace3d81701bf9b4c4e035ece9935c1f5 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:37:48 -0400 Subject: [PATCH 5/5] ci: fix CodeQL language JSON generation --- .github/workflows/codeql.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b3f48b1..f6a1ed3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,8 +26,7 @@ jobs: [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp" [ -n "$langs" ] || langs=' python' - json="$(printf '%s\n' $langs | jq -Rsc 'split(" -") | map(select(length > 0))')" + json="$(jq -cn --arg l "$langs" '$l | split(" ") | map(select(length > 0))')" echo "languages=$json" >> "$GITHUB_OUTPUT" analyze: needs: detect