From edda299151b98ba9bcea2c0ce7c8ff3cb8d36b3f Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 09:18:17 +0000 Subject: [PATCH 1/4] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 7 ++++--- .github/workflows/codeql.yml | 12 ++++++++++++ .../workflows/debug-artifacts-failure-safe.yml | 12 ++++++++++++ .github/workflows/debug-artifacts-safe.yml | 12 ++++++++++++ .github/workflows/post-release-mergeback.yml | 6 ++++++ .github/workflows/pr-checks.yml | 6 ++++++ .github/workflows/prepare-release.yml | 6 ++++++ .github/workflows/python312-windows.yml | 6 ++++++ .github/workflows/query-filters.yml | 6 ++++++ .github/workflows/rebuild.yml | 6 ++++++ .github/workflows/rollback-release.yml | 6 ++++++ .github/workflows/update-bundle.yml | 6 ++++++ .github/workflows/update-release-branch.yml | 12 ++++++++++++ .pre-commit-config.yaml | 17 +++++++++++++++++ 14 files changed, 117 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d29c1e106c..afaa5e6c29 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -27,10 +27,11 @@ updates: - "patch" - package-ecosystem: github-actions directories: - - "/.github/workflows" - - "/.github/actions" + - /.github/workflows + - /.github/actions + - / schedule: - interval: weekly + interval: daily cooldown: default-days: 7 exclude: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f27de17fd8..2c0945bddf 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,6 +32,12 @@ jobs: security-events: read steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up default CodeQL bundle id: setup-default @@ -119,6 +125,12 @@ jobs: security-events: write steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index f67cef5c75..6aefd8ed6b 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -45,6 +45,12 @@ jobs: timeout-minutes: 45 runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Dump GitHub event run: cat "${GITHUB_EVENT_PATH}" - name: Check out repository @@ -88,6 +94,12 @@ jobs: contents: read runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Download all artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - name: Check expected artifacts exist diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index c27f195113..07868a624a 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -43,6 +43,12 @@ jobs: security-events: read runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test @@ -81,6 +87,12 @@ jobs: contents: read runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Download all artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - name: Check expected artifacts exist diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index c493c2a382..5c2ce97035 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -36,6 +36,12 @@ jobs: pull-requests: write steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Dump environment run: env diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index ac61475d62..a8a2a6af7a 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -87,6 +87,12 @@ jobs: group: pr-checks-pr-checks-${{ github.ref }}-${{ github.event_name }} steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 4eb300704d..e7ab04b279 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -43,6 +43,12 @@ jobs: backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }} steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index ab169499e2..15e9164d99 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -32,6 +32,12 @@ jobs: runs-on: windows-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.12 diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 87b934eb6b..fb18465a1b 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -29,6 +29,12 @@ jobs: permissions: contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository. steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index faa32c65d9..5ae0d190e5 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -23,6 +23,12 @@ jobs: contents: write # needed to push rebuilt commit pull-requests: write # needed to comment on the PR steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index c37f8a79ae..d48f4ec21f 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -51,6 +51,12 @@ jobs: pull-requests: write # needed to create the mergeback PR steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index d3ee924e59..09af549161 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -25,6 +25,12 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull requests steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Dump environment run: env diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index 9f38f0f0b4..938256001f 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -38,6 +38,12 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs @@ -93,6 +99,12 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Generate token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 id: app-token diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e1ae3d243a..b97f742ffe 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -18,3 +18,20 @@ repos: language: system entry: pr-checks/sync.sh pass_filenames: false + - repo: https://github.com/gitleaks/gitleaks + rev: v8.30.1 + hooks: + - id: gitleaks + - repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck + - repo: https://github.com/pre-commit/mirrors-eslint + rev: v10.8.0 + hooks: + - id: eslint + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v6.0.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace From 7e27b359df431ba349747b7e6caf7d3e11b7fa47 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 17 Aug 2026 23:53:34 +0000 Subject: [PATCH 2/4] Bump js-yaml and tar to patched versions (dev-only transitives) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears the two open advisories reported by `npm audit` against the locked dependency tree. Both fixes land inside the existing semver ranges, so only `package-lock.json` changes: - js-yaml 4.3.0 -> 4.3.1 and 3.15.0 -> 3.15.1 (GHSA-5p4m-2wfm-xmqj, CVE-2026-59870, high): quadratic CPU consumption resolving `!!omap`. Reached via @microsoft/eslint-formatter-sarif and supertap. - tar 7.5.20 -> 7.5.22 (GHSA-r292-9mhp-454m, moderate): uncontrolled recursion in mapHas/filesFilter allows an uncatchable stack-overflow DoS from a crafted long-path archive. Reached via @mapbox/node-pre-gyp. All three are dev-only dependencies, so the bundled output in `lib/` does not change and needs no rebuild. The root `js-yaml` direct dependency stays pinned at 5.2.3 — the 5.x line was already patched in 5.2.1 and is unaffected, so it is deliberately left out of this diff to keep the change security-scoped. Verified locally: `npm ci`, `npm run build`, and `npm run lint` all pass, and `npm audit` reports 0 vulnerabilities. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01QVUWKDpMHifLWzEYPF4NKL --- package-lock.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index 6a74ca0270..bce5699de2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1980,9 +1980,9 @@ } }, "node_modules/@microsoft/eslint-formatter-sarif/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { @@ -8934,9 +8934,9 @@ } }, "node_modules/supertap/node_modules/js-yaml": { - "version": "3.15.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", - "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", + "version": "3.15.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", + "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", "dev": true, "license": "MIT", "dependencies": { @@ -9013,9 +9013,9 @@ } }, "node_modules/tar": { - "version": "7.5.20", - "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.20.tgz", - "integrity": "sha512-9FcyK4PA6+WbzlTM9WhQm6vB5W7cP7dUiPsv1g7YDwEQnQ1CGpK3MGlKk/ITVWMk05kHZuBhmVhiv8LZoy/PFQ==", + "version": "7.5.22", + "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz", + "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==", "dev": true, "license": "BlueOak-1.0.0", "dependencies": { From e5d08eb130daeb715219ee7b419f5b788f662e0a Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 27 Aug 2026 16:03:27 +0000 Subject: [PATCH 3/4] docs: add FORK.md explaining this fork and its related repositories Nothing in the tree said this was a fork, why it exists, or how it relates to the SakThai repos that sit alongside it. Add FORK.md recording the two dev-only advisory bumps it carries (js-yaml GHSA-5p4m-2wfm-xmqj, tar GHSA-r292-9mhp-454m), links to the sibling repos, and the point that matters most: no workflow in those repos references this fork. They pin upstream `github/codeql-action` by commit SHA, and repointing them here would defeat the SHA-pinning Scorecard's Pinned-Dependencies check relies on. The README gets a single blockquote line pointing at FORK.md, kept to one line so syncing from upstream stays a trivial resolution. Everything else in README.md is upstream's and is untouched. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01DKk5SVtHLSPCwSDASJhfRL --- FORK.md | 38 ++++++++++++++++++++++++++++++++++++++ README.md | 2 ++ 2 files changed, 40 insertions(+) create mode 100644 FORK.md diff --git a/FORK.md b/FORK.md new file mode 100644 index 0000000000..38080a9eac --- /dev/null +++ b/FORK.md @@ -0,0 +1,38 @@ +# Fork notes + +This is a fork of [`github/codeql-action`](https://github.com/github/codeql-action), +maintained under [`beer-sakthai`](https://github.com/beer-sakthai) alongside the SakThai +family repositories. Upstream's own documentation in [`README.md`](README.md) still +applies in full — this file records only what is specific to the fork. + +## Why the fork exists + +To stage dependency-advisory remediation against the action's **own** dev-dependency +tree, where a fix is available inside the existing semver ranges and touches only +`package-lock.json`. So far: + +- `js-yaml` 4.3.0 → 4.3.1 and 3.15.0 → 3.15.1 (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870) +- `tar` 7.5.20 → 7.5.22 (GHSA-r292-9mhp-454m) + +Both are dev-only, so the bundled output under `lib/` is unchanged and needs no rebuild. + +## What the fork is *not* + +**No workflow in the SakThai repositories references this fork.** They pin **upstream** +`github/codeql-action` by commit SHA: + +- [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) — + `codeql.yml`, `bandit.yml`, `ossar.yml`, `scorecard.yml` +- [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) — + `codeql.yml`, `ossar.yml` + +Repointing any of them at this fork would defeat the SHA-pinning those repos rely on for +Scorecard's Pinned-Dependencies check. Consume upstream; use this fork to prepare patches. + +## Related repositories + +| Repository | What it is | +|---|---| +| [`github/codeql-action`](https://github.com/github/codeql-action) | Upstream. The source of truth for everything in `README.md` and `CHANGELOG.md`. | +| [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) | The Sak family agent runtime — `sakthai` package, six personas, memory, MCP, web API. | +| [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) | The SFT + GRPO training and evaluation pipeline behind the family's models. | diff --git a/README.md b/README.md index 530c028f97..81b0f634cf 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # CodeQL Action +> **Fork of [`github/codeql-action`](https://github.com/github/codeql-action).** See [`FORK.md`](FORK.md) for what differs and for the related SakThai repositories. Everything below is upstream documentation and applies unchanged. + This action runs GitHub's industry-leading semantic code analysis engine, [CodeQL](https://codeql.github.com/), against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code. For a list of recent changes, see the CodeQL Action's [changelog](CHANGELOG.md). From 2bcac7e80ba786d4b59e51ffff4a4593531d5de0 Mon Sep 17 00:00:00 2001 From: beer-sakthai <2.93853443e+08+beer-sakthai@users.noreply.github.com> Date: Mon, 7 Sep 2026 12:23:24 +0000 Subject: [PATCH 4/4] chore: add repository maintainer skill --- .../skills/codeql-action-maintainer/SKILL.md | 56 +++++++++++++++++++ .../references/repository-map.md | 20 +++++++ .../references/security-and-release.md | 30 ++++++++++ 3 files changed, 106 insertions(+) create mode 100644 .manus/skills/codeql-action-maintainer/SKILL.md create mode 100644 .manus/skills/codeql-action-maintainer/references/repository-map.md create mode 100644 .manus/skills/codeql-action-maintainer/references/security-and-release.md diff --git a/.manus/skills/codeql-action-maintainer/SKILL.md b/.manus/skills/codeql-action-maintainer/SKILL.md new file mode 100644 index 0000000000..5fdb619f8f --- /dev/null +++ b/.manus/skills/codeql-action-maintainer/SKILL.md @@ -0,0 +1,56 @@ +--- +name: codeql-action-maintainer +description: "Maintain, test, audit, and safely integrate changes in beer-sakthai/codeql-action. Use for CodeQL Action TypeScript changes, action bundling, workflow fixtures, dependency advisories, CodeQL/OSSAR checks, release branches, rollback, and security-sensitive pull requests." +--- + +# CodeQL Action Maintainer + +Maintain this repository as a security-sensitive fork/staging area for CodeQL Action work. Treat source, generated bundles, workflow fixtures, dependency metadata, and release automation as separate surfaces with separate verification requirements. + +## Start every task + +1. Work from the repository root and inspect the current branch, worktree, remotes, recent commits, `README.md`, contribution guidance, and release notes. +2. Determine whether the change affects TypeScript source, generated `dist/` bundles, workflow fixtures, dependency advisories, action metadata, or release/rollback automation. +3. Read the nearest tests and workflow that exercise the changed surface before editing. +4. Inspect package scripts and lockfiles. Use the repository’s pinned Node/npm toolchain rather than guessing versions. +5. Keep a short plan for multi-file or security-sensitive changes. + +## Repository surfaces + +- `src/`: TypeScript action source and shared utilities. +- `__tests__/`, `pr-checks/`, and related fixtures: unit, integration, and workflow validation. +- `.github/workflows/`: large matrix of PR checks, bundle checks, release preparation, rollback, and security workflows. +- `action.yml`: intentionally a stub in this fork; do not treat it as a normal runtime action entrypoint. +- `dist/` or generated release outputs: update only when the project’s build/release procedure requires it. +- `package.json`, lockfiles, advisory/configuration files, and release manifests: supply-chain-sensitive metadata. + +Use [repository-map.md](references/repository-map.md) for command and surface mapping. Use [security-and-release.md](references/security-and-release.md) for dependency, bundle, release, and rollback rules. + +## Editing rules + +- Preserve security boundaries, permissions, pinned action references, checksums, and secret-handling behavior. +- For dependency remediation, change only the intended dependency tree, regenerate the lockfile with the declared toolchain, and inspect the full dependency diff. +- Do not edit generated bundles by hand. Run the canonical build/package command and review generated output for unintended changes. +- For workflow changes, inspect triggers, permissions, `pull_request` safety, fork handling, artifact retention, and release branch behavior. +- Treat code scanning, SARIF upload, query packs, and release archives as security-sensitive outputs. +- Add or update focused tests for changed behavior. Do not weaken assertions or skip security tests to obtain green CI. +- Never add credentials, downloaded binaries, unreviewed third-party scripts, or generated artifacts without explicit provenance. + +## Verification workflow + +1. Run `git diff --check` and inspect changed source, lockfiles, generated output, and workflow YAML. +2. Install dependencies with the repository’s declared package-manager lockfile. +3. Run the focused tests first, then the relevant lint, typecheck, bundle/build, and workflow fixture checks from `package.json` and the applicable `.github/workflows/` files. +4. For security changes, run the relevant CodeQL/OSSAR/dependency checks and compare alert or advisory scope before and after the change. +5. If the complete matrix is GitHub-only, report local limitations and wait for required remote checks rather than claiming local equivalence. + +## GitHub and release workflow + +- Treat `main` and release branches as protected. Use a descriptive branch and pull request; never bypass required checks or force-push shared history. +- Inspect required PR checks with `gh pr view` and merge only when the repository reports a clean merge state with all required checks green or explicitly accepted neutral/skipped checks. +- Before release or rollback changes, verify version/tag inputs, generated release files, provenance, and the intended target branch. +- Delete temporary branches only after merge and after confirming their tips are ancestors of `main`. + +## Completion report + +Report the source and generated files changed, dependency/advisory impact, local and remote checks, PR and merge commit, release implications, and final remote branch state. Clearly distinguish verified security results from static review observations. diff --git a/.manus/skills/codeql-action-maintainer/references/repository-map.md b/.manus/skills/codeql-action-maintainer/references/repository-map.md new file mode 100644 index 0000000000..6b61e73c3c --- /dev/null +++ b/.manus/skills/codeql-action-maintainer/references/repository-map.md @@ -0,0 +1,20 @@ +# codeql-action Repository Map + +| Area | Location | Role | +|---|---|---| +| TypeScript source | `src/` | CodeQL Action implementation and shared utilities. | +| Tests and fixtures | `__tests__/`, `pr-checks/`, and related fixture directories | Unit, integration, workflow, and release validation. | +| Action metadata | `action.yml` | Stub metadata in this fork; not a normal runtime entrypoint. | +| Generated output | `dist/` or release-generated bundles | Rebuilt artifacts; do not hand-edit. | +| Workflows | `.github/workflows/` | PR checks, build/bundle matrices, code scanning, release preparation, rollback, and maintenance. | +| Dependency metadata | `package.json`, lockfiles, advisory/configuration files | Supply-chain and reproducibility controls. | + +## Discovery commands + +```bash +node -e "const p=require('./package.json'); console.log(JSON.stringify(p.scripts,null,2))" +find .github/workflows -maxdepth 1 -type f -printf '%f\n' | sort +find . -maxdepth 3 -type f \( -iname '*lock*' -o -iname '*dependabot*' -o -iname '*audit*' \) -print | sort +``` + +Always use the scripts and package-manager lockfile declared by the current checkout. Read the applicable workflow before changing a generated bundle or release path. diff --git a/.manus/skills/codeql-action-maintainer/references/security-and-release.md b/.manus/skills/codeql-action-maintainer/references/security-and-release.md new file mode 100644 index 0000000000..00c1060dd4 --- /dev/null +++ b/.manus/skills/codeql-action-maintainer/references/security-and-release.md @@ -0,0 +1,30 @@ +# Security and Release Safety + +## Dependency remediation + +1. Identify the exact vulnerable package and dependency tree. +2. Change the smallest supported version range or override. +3. Regenerate the lockfile with the repository’s declared toolchain. +4. Inspect the complete lockfile and package diff for unrelated upgrades. +5. Run the focused tests, lint/typecheck, dependency review, and security workflows. +6. Record advisory identifiers, affected scope, and residual risk. + +Do not claim that changing a development dependency fixes a vulnerability in a published action unless the runtime and release contents have been verified. + +## Bundles and generated files + +Build generated bundles using the canonical package script. Review file lists, source maps, licenses, and checksums. Never patch `dist/` manually to hide a source or build failure. Ensure the generated output corresponds to the intended source commit and dependency lockfile. + +## Workflow safety + +Review `permissions`, fork behavior, token use, artifact uploads, release refs, and `pull_request_target` boundaries. Treat downloaded archives, third-party actions, release tags, and SARIF inputs as untrusted until provenance and integrity are established. + +## Release and rollback + +Before a release or rollback: + +- Verify the target branch and version/tag inputs. +- Confirm expected release files and generated bundles. +- Review immutable references, provenance, and artifact checksums. +- Confirm that rollback scope is intentional and does not rewrite shared history. +- Wait for required CI and security checks before merging.