diff options
| author | Leitwolf11 | 2026-10-10 20:22:57 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-10-10 20:22:57 +0300 |
| commit | af41dcfb2da79fa9b864b57a8472334155896d93 (patch) | |
| tree | 862b2cba91e0a3c64aa82b79ea7fae77c3cad566 /.github/workflows/codeql.yml | |
| parent | bd009a31cbc06ccecbb870e60cf5d7868a3c8722 (diff) | |
| download | website-af41dcfb2da79fa9b864b57a8472334155896d93.tar.gz | |
Add workflow, repository and dependency analysis
zizmor audits the workflows themselves for what makes a workflow
unsafe, and uploads what it finds to code scanning. Its first run here
found one thing, 4 times: a checkout that leaves the job's token in
the checked-out repository, where any later step can read it. No
workflow pushes or needs the token after the checkout, so every checkout
now sets persist-credentials to false, and zizmor reports nothing.
OpenSSF Scorecard grades how the repository is kept: branch protection,
pinned dependencies, token permissions and the like. It runs on the
default branch and weekly, publishes its score and uploads its findings to
code scanning.
Dependency Review fails a pull request that adds or changes a dependency
with a known vulnerability of high severity or worse. Dependabot watches
what is already there; this holds what comes in.
Every new action is pinned to a commit, each job names the permissions
it needs, and no new workflow has a default permission.
Diffstat (limited to '.github/workflows/codeql.yml')
| -rw-r--r-- | .github/workflows/codeql.yml | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0b29f44..c5dde81 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -29,6 +29,8 @@ jobs: build_mode: manual steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 if: matrix.language == 'java-kotlin' with: |