diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d29c1e106c..afaa5e6c29 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -27,10 +27,11 @@ updates: - "patch" - package-ecosystem: github-actions directories: - - "/.github/workflows" - - "/.github/actions" + - /.github/workflows + - /.github/actions + - / schedule: - interval: weekly + interval: daily cooldown: default-days: 7 exclude: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f27de17fd8..2c0945bddf 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,6 +32,12 @@ jobs: security-events: read steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up default CodeQL bundle id: setup-default @@ -119,6 +125,12 @@ jobs: security-events: write steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL diff --git a/.github/workflows/debug-artifacts-failure-safe.yml b/.github/workflows/debug-artifacts-failure-safe.yml index f67cef5c75..6aefd8ed6b 100644 --- a/.github/workflows/debug-artifacts-failure-safe.yml +++ b/.github/workflows/debug-artifacts-failure-safe.yml @@ -45,6 +45,12 @@ jobs: timeout-minutes: 45 runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Dump GitHub event run: cat "${GITHUB_EVENT_PATH}" - name: Check out repository @@ -88,6 +94,12 @@ jobs: contents: read runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Download all artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - name: Check expected artifacts exist diff --git a/.github/workflows/debug-artifacts-safe.yml b/.github/workflows/debug-artifacts-safe.yml index c27f195113..07868a624a 100644 --- a/.github/workflows/debug-artifacts-safe.yml +++ b/.github/workflows/debug-artifacts-safe.yml @@ -43,6 +43,12 @@ jobs: security-events: read runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Prepare test @@ -81,6 +87,12 @@ jobs: contents: read runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Download all artifacts uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - name: Check expected artifacts exist diff --git a/.github/workflows/post-release-mergeback.yml b/.github/workflows/post-release-mergeback.yml index c493c2a382..5c2ce97035 100644 --- a/.github/workflows/post-release-mergeback.yml +++ b/.github/workflows/post-release-mergeback.yml @@ -36,6 +36,12 @@ jobs: pull-requests: write steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Dump environment run: env diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index 3915fddf53..11734f6aa0 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -119,6 +119,12 @@ jobs: group: pr-checks-pr-checks-${{ github.ref }}-${{ github.event_name }} steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 4eb300704d..e7ab04b279 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -43,6 +43,12 @@ jobs: backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }} steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/python312-windows.yml b/.github/workflows/python312-windows.yml index ab169499e2..15e9164d99 100644 --- a/.github/workflows/python312-windows.yml +++ b/.github/workflows/python312-windows.yml @@ -32,6 +32,12 @@ jobs: runs-on: windows-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: 3.12 diff --git a/.github/workflows/query-filters.yml b/.github/workflows/query-filters.yml index 87b934eb6b..fb18465a1b 100644 --- a/.github/workflows/query-filters.yml +++ b/.github/workflows/query-filters.yml @@ -29,6 +29,12 @@ jobs: permissions: contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository. steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/rebuild.yml b/.github/workflows/rebuild.yml index faa32c65d9..5ae0d190e5 100644 --- a/.github/workflows/rebuild.yml +++ b/.github/workflows/rebuild.yml @@ -23,6 +23,12 @@ jobs: contents: write # needed to push rebuilt commit pull-requests: write # needed to comment on the PR steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/rollback-release.yml b/.github/workflows/rollback-release.yml index c37f8a79ae..d48f4ec21f 100644 --- a/.github/workflows/rollback-release.yml +++ b/.github/workflows/rollback-release.yml @@ -51,6 +51,12 @@ jobs: pull-requests: write # needed to create the mergeback PR steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/update-bundle.yml b/.github/workflows/update-bundle.yml index d3ee924e59..09af549161 100644 --- a/.github/workflows/update-bundle.yml +++ b/.github/workflows/update-bundle.yml @@ -25,6 +25,12 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull requests steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Dump environment run: env diff --git a/.github/workflows/update-release-branch.yml b/.github/workflows/update-release-branch.yml index 9f38f0f0b4..938256001f 100644 --- a/.github/workflows/update-release-branch.yml +++ b/.github/workflows/update-release-branch.yml @@ -38,6 +38,12 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Need full history for calculation of diffs @@ -93,6 +99,12 @@ jobs: contents: write # needed to push commits pull-requests: write # needed to create pull request steps: + - name: Harden the runner + uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + with: + use-policy-store: true + api-key: ${{ secrets.STEP_SECURITY_API_KEY }} + - name: Generate token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 id: app-token diff --git a/.manus/skills/codeql-action-maintainer/SKILL.md b/.manus/skills/codeql-action-maintainer/SKILL.md new file mode 100644 index 0000000000..5fdb619f8f --- /dev/null +++ b/.manus/skills/codeql-action-maintainer/SKILL.md @@ -0,0 +1,56 @@ +--- +name: codeql-action-maintainer +description: "Maintain, test, audit, and safely integrate changes in beer-sakthai/codeql-action. Use for CodeQL Action TypeScript changes, action bundling, workflow fixtures, dependency advisories, CodeQL/OSSAR checks, release branches, rollback, and security-sensitive pull requests." +--- + +# CodeQL Action Maintainer + +Maintain this repository as a security-sensitive fork/staging area for CodeQL Action work. Treat source, generated bundles, workflow fixtures, dependency metadata, and release automation as separate surfaces with separate verification requirements. + +## Start every task + +1. Work from the repository root and inspect the current branch, worktree, remotes, recent commits, `README.md`, contribution guidance, and release notes. +2. Determine whether the change affects TypeScript source, generated `dist/` bundles, workflow fixtures, dependency advisories, action metadata, or release/rollback automation. +3. Read the nearest tests and workflow that exercise the changed surface before editing. +4. Inspect package scripts and lockfiles. Use the repository’s pinned Node/npm toolchain rather than guessing versions. +5. Keep a short plan for multi-file or security-sensitive changes. + +## Repository surfaces + +- `src/`: TypeScript action source and shared utilities. +- `__tests__/`, `pr-checks/`, and related fixtures: unit, integration, and workflow validation. +- `.github/workflows/`: large matrix of PR checks, bundle checks, release preparation, rollback, and security workflows. +- `action.yml`: intentionally a stub in this fork; do not treat it as a normal runtime action entrypoint. +- `dist/` or generated release outputs: update only when the project’s build/release procedure requires it. +- `package.json`, lockfiles, advisory/configuration files, and release manifests: supply-chain-sensitive metadata. + +Use [repository-map.md](references/repository-map.md) for command and surface mapping. Use [security-and-release.md](references/security-and-release.md) for dependency, bundle, release, and rollback rules. + +## Editing rules + +- Preserve security boundaries, permissions, pinned action references, checksums, and secret-handling behavior. +- For dependency remediation, change only the intended dependency tree, regenerate the lockfile with the declared toolchain, and inspect the full dependency diff. +- Do not edit generated bundles by hand. Run the canonical build/package command and review generated output for unintended changes. +- For workflow changes, inspect triggers, permissions, `pull_request` safety, fork handling, artifact retention, and release branch behavior. +- Treat code scanning, SARIF upload, query packs, and release archives as security-sensitive outputs. +- Add or update focused tests for changed behavior. Do not weaken assertions or skip security tests to obtain green CI. +- Never add credentials, downloaded binaries, unreviewed third-party scripts, or generated artifacts without explicit provenance. + +## Verification workflow + +1. Run `git diff --check` and inspect changed source, lockfiles, generated output, and workflow YAML. +2. Install dependencies with the repository’s declared package-manager lockfile. +3. Run the focused tests first, then the relevant lint, typecheck, bundle/build, and workflow fixture checks from `package.json` and the applicable `.github/workflows/` files. +4. For security changes, run the relevant CodeQL/OSSAR/dependency checks and compare alert or advisory scope before and after the change. +5. If the complete matrix is GitHub-only, report local limitations and wait for required remote checks rather than claiming local equivalence. + +## GitHub and release workflow + +- Treat `main` and release branches as protected. Use a descriptive branch and pull request; never bypass required checks or force-push shared history. +- Inspect required PR checks with `gh pr view` and merge only when the repository reports a clean merge state with all required checks green or explicitly accepted neutral/skipped checks. +- Before release or rollback changes, verify version/tag inputs, generated release files, provenance, and the intended target branch. +- Delete temporary branches only after merge and after confirming their tips are ancestors of `main`. + +## Completion report + +Report the source and generated files changed, dependency/advisory impact, local and remote checks, PR and merge commit, release implications, and final remote branch state. Clearly distinguish verified security results from static review observations. diff --git a/.manus/skills/codeql-action-maintainer/references/repository-map.md b/.manus/skills/codeql-action-maintainer/references/repository-map.md new file mode 100644 index 0000000000..6b61e73c3c --- /dev/null +++ b/.manus/skills/codeql-action-maintainer/references/repository-map.md @@ -0,0 +1,20 @@ +# codeql-action Repository Map + +| Area | Location | Role | +|---|---|---| +| TypeScript source | `src/` | CodeQL Action implementation and shared utilities. | +| Tests and fixtures | `__tests__/`, `pr-checks/`, and related fixture directories | Unit, integration, workflow, and release validation. | +| Action metadata | `action.yml` | Stub metadata in this fork; not a normal runtime entrypoint. | +| Generated output | `dist/` or release-generated bundles | Rebuilt artifacts; do not hand-edit. | +| Workflows | `.github/workflows/` | PR checks, build/bundle matrices, code scanning, release preparation, rollback, and maintenance. | +| Dependency metadata | `package.json`, lockfiles, advisory/configuration files | Supply-chain and reproducibility controls. | + +## Discovery commands + +```bash +node -e "const p=require('./package.json'); console.log(JSON.stringify(p.scripts,null,2))" +find .github/workflows -maxdepth 1 -type f -printf '%f\n' | sort +find . -maxdepth 3 -type f \( -iname '*lock*' -o -iname '*dependabot*' -o -iname '*audit*' \) -print | sort +``` + +Always use the scripts and package-manager lockfile declared by the current checkout. Read the applicable workflow before changing a generated bundle or release path. diff --git a/.manus/skills/codeql-action-maintainer/references/security-and-release.md b/.manus/skills/codeql-action-maintainer/references/security-and-release.md new file mode 100644 index 0000000000..00c1060dd4 --- /dev/null +++ b/.manus/skills/codeql-action-maintainer/references/security-and-release.md @@ -0,0 +1,30 @@ +# Security and Release Safety + +## Dependency remediation + +1. Identify the exact vulnerable package and dependency tree. +2. Change the smallest supported version range or override. +3. Regenerate the lockfile with the repository’s declared toolchain. +4. Inspect the complete lockfile and package diff for unrelated upgrades. +5. Run the focused tests, lint/typecheck, dependency review, and security workflows. +6. Record advisory identifiers, affected scope, and residual risk. + +Do not claim that changing a development dependency fixes a vulnerability in a published action unless the runtime and release contents have been verified. + +## Bundles and generated files + +Build generated bundles using the canonical package script. Review file lists, source maps, licenses, and checksums. Never patch `dist/` manually to hide a source or build failure. Ensure the generated output corresponds to the intended source commit and dependency lockfile. + +## Workflow safety + +Review `permissions`, fork behavior, token use, artifact uploads, release refs, and `pull_request_target` boundaries. Treat downloaded archives, third-party actions, release tags, and SARIF inputs as untrusted until provenance and integrity are established. + +## Release and rollback + +Before a release or rollback: + +- Verify the target branch and version/tag inputs. +- Confirm expected release files and generated bundles. +- Review immutable references, provenance, and artifact checksums. +- Confirm that rollback scope is intentional and does not rewrite shared history. +- Wait for required CI and security checks before merging. diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e1ae3d243a..b97f742ffe 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -18,3 +18,20 @@ repos: language: system entry: pr-checks/sync.sh pass_filenames: false + - repo: https://github.com/gitleaks/gitleaks + rev: v8.30.1 + hooks: + - id: gitleaks + - repo: https://github.com/jumanjihouse/pre-commit-hooks + rev: 3.0.0 + hooks: + - id: shellcheck + - repo: https://github.com/pre-commit/mirrors-eslint + rev: v10.8.0 + hooks: + - id: eslint + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v6.0.0 + hooks: + - id: end-of-file-fixer + - id: trailing-whitespace diff --git a/FORK.md b/FORK.md new file mode 100644 index 0000000000..38080a9eac --- /dev/null +++ b/FORK.md @@ -0,0 +1,38 @@ +# Fork notes + +This is a fork of [`github/codeql-action`](https://github.com/github/codeql-action), +maintained under [`beer-sakthai`](https://github.com/beer-sakthai) alongside the SakThai +family repositories. Upstream's own documentation in [`README.md`](README.md) still +applies in full — this file records only what is specific to the fork. + +## Why the fork exists + +To stage dependency-advisory remediation against the action's **own** dev-dependency +tree, where a fix is available inside the existing semver ranges and touches only +`package-lock.json`. So far: + +- `js-yaml` 4.3.0 → 4.3.1 and 3.15.0 → 3.15.1 (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870) +- `tar` 7.5.20 → 7.5.22 (GHSA-r292-9mhp-454m) + +Both are dev-only, so the bundled output under `lib/` is unchanged and needs no rebuild. + +## What the fork is *not* + +**No workflow in the SakThai repositories references this fork.** They pin **upstream** +`github/codeql-action` by commit SHA: + +- [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) — + `codeql.yml`, `bandit.yml`, `ossar.yml`, `scorecard.yml` +- [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) — + `codeql.yml`, `ossar.yml` + +Repointing any of them at this fork would defeat the SHA-pinning those repos rely on for +Scorecard's Pinned-Dependencies check. Consume upstream; use this fork to prepare patches. + +## Related repositories + +| Repository | What it is | +|---|---| +| [`github/codeql-action`](https://github.com/github/codeql-action) | Upstream. The source of truth for everything in `README.md` and `CHANGELOG.md`. | +| [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) | The Sak family agent runtime — `sakthai` package, six personas, memory, MCP, web API. | +| [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) | The SFT + GRPO training and evaluation pipeline behind the family's models. | diff --git a/README.md b/README.md index 530c028f97..81b0f634cf 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # CodeQL Action +> **Fork of [`github/codeql-action`](https://github.com/github/codeql-action).** See [`FORK.md`](FORK.md) for what differs and for the related SakThai repositories. Everything below is upstream documentation and applies unchanged. + This action runs GitHub's industry-leading semantic code analysis engine, [CodeQL](https://codeql.github.com/), against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code. For a list of recent changes, see the CodeQL Action's [changelog](CHANGELOG.md).