feat(scripts): SHA-pin tooling Suggested-tier follow-up (#176 review) #385

	# CodeQL Security Analysis
	# Performs static application security testing (SAST) on GitHub Actions workflows.
	#
	# IMPORTANT: GitHub's CodeQL "default setup" must remain DISABLED for this repo.
	# Default setup and custom advanced configuration cannot both upload SARIF to the
	# Security tab -- GitHub rejects the custom upload with "analyses from advanced
	# configurations cannot be processed when the default setup is enabled."
	# To verify or disable: Settings > Code security > Code scanning > Default setup.
	name: CodeQL Analysis

	on:
	push:
	branches:
	- main
	- master
	pull_request:
	branches:
	- main
	- master
	schedule:
	# Weekly scan on Mondays at 07:00 UTC
	- cron: "0 7 * * 1"
	workflow_dispatch:

	permissions: {}

	concurrency:
	group: codeql-${{ github.ref }}
	cancel-in-progress: false

	jobs:
	analyze:
	name: CodeQL Analyze
	runs-on: ubuntu-latest
	timeout-minutes: 30
	permissions:
	actions: read
	contents: read
	security-events: write

	steps:
	- name: Harden the runner
	uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
	with:
	egress-policy: audit

	- name: Checkout repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Initialize CodeQL
	uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
	with:
	languages: actions
	queries: security-extended,security-and-quality

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
	with:
	category: "/language:actions"

Navigation Menu