From f415cf75cdcf5c6b999dee3f693651526348893e Mon Sep 17 00:00:00 2001 From: Mike Linksvayer Date: Tue, 23 Jun 2026 13:09:48 -0400 Subject: [PATCH 1/2] Add advanced CodeQL workflow --- .github/workflows/codeql.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..7b43e1362 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,30 @@ +name: CodeQL + +on: + push: + branches: [gh-pages] + pull_request: + branches: [gh-pages] + +permissions: + contents: read + security-events: write + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + language: [actions, javascript-typescript, ruby] + + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + + - uses: github/codeql-action/init@v4 + with: + languages: ${{ matrix.language }} + + - uses: github/codeql-action/analyze@v4 From 24edf7fe039861ebda6565ec0bc9972dd5aff586 Mon Sep 17 00:00:00 2001 From: Mike Linksvayer Date: Tue, 23 Jun 2026 14:37:38 -0400 Subject: [PATCH 2/2] Pin CodeQL action in advanced workflow --- .github/workflows/codeql.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7b43e1362..69271d15a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -12,7 +12,7 @@ permissions: jobs: analyze: - name: Analyze (${{ matrix.language }}) + name: Analyze ${{ matrix.language }} runs-on: ubuntu-latest strategy: @@ -22,9 +22,11 @@ jobs: steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + with: + persist-credentials: false - - uses: github/codeql-action/init@v4 + - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e with: languages: ${{ matrix.language }} - - uses: github/codeql-action/analyze@v4 + - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e