refactor: collapse .plugin/{agents,commands} mirror — single SoT at .… #50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # CodeQL static analysis — Myco v0.6.12+ | |
| # | |
| # Runs GitHub's native code-scanning engine against the substrate's | |
| # Python sources (src/ + scripts/ + tests/) on every push to main, | |
| # every PR targeting main, and on a weekly cron in case the CodeQL | |
| # ruleset expands between Myco releases. | |
| # | |
| # Queries pack: ``security-and-quality`` (the broader of the two | |
| # stock packs — covers OWASP-style data-flow + style-quality issues). | |
| # Findings surface in the repo's Security tab → Code scanning alerts. | |
| # | |
| # Output also feeds the Glama maintenance score's "security health" | |
| # 15% slot via GitHub's code-scanning API endpoint. | |
| # | |
| # Reference: docs/architecture/L2_DOCTRINE/boundary.md | |
| # (boundary subsystem owns the external-facing security analysis surface). | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Weekly Monday 04:23 UTC — staggered off other workflows. | |
| - cron: "23 4 * * 1" | |
| # Default permissions: deny-by-default; jobs widen explicitly. | |
| permissions: | |
| contents: read | |
| # Cancel in-flight CodeQL runs on the same ref to avoid redundant | |
| # work when force-pushes land mid-analysis. | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| # Required for CodeQL to write SARIF results back to the | |
| # repo's Security tab. | |
| security-events: write | |
| # Required for actions/checkout @ v4. | |
| contents: read | |
| # Required for CodeQL to read workflow runs (provenance). | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ["python"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Python 3.12 | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # ``security-and-quality`` = security-extended + code-quality. | |
| # Broader-net than the default ``security-extended``; we | |
| # accept the slightly higher false-positive rate for the | |
| # stronger signal. | |
| queries: security-and-quality | |
| # Track config changes alongside source changes — CodeQL | |
| # version updates land via dependabot github-actions PRs. | |
| # v0.8.5 — paths align with the v0.8.4 root-cleanup. The | |
| # previous config (scripts, tests, src) was silently scanning | |
| # only src/ because the other two directories had moved to | |
| # .scripts/ and .tests/ — halving CodeQL's effective surface. | |
| config: | | |
| paths: | |
| - src | |
| - .scripts | |
| - .tests | |
| - name: Install Myco (so autobuild can resolve imports) | |
| run: | | |
| python -m pip install --upgrade pip | |
| python -m pip install -e ".[dev,mcp,adapters]" | |
| - name: Autobuild | |
| # Python is interpreted; autobuild is a no-op extract step, | |
| # but kept here for symmetry with compiled-language jobs and | |
| # future-proofing against language matrix expansion. | |
| uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| # Upload the SARIF results to the Security tab. | |
| upload: always |