This repository was archived by the owner on Jul 23, 2026. It is now read-only.

ci: ps-lint informational mode; codeql now scans Actions workflows (w… #9

	name: CodeQL SAST - Static Analysis

	# Scans the repo's GitHub Actions workflow files for common security issues
	# (script injection, untrusted input flowing to shell, missing permissions,
	# unpinned action versions, etc.). Part of the DevSecOps pipeline.
	#
	# This repo is PowerShell + Markdown + YAML - no Python, no compiled languages.
	# CodeQL's `actions` language scans workflow YAML directly, which is the real
	# attack surface here: workflows have write access to the repo and secrets.
	#
	# Results land in: GitHub -> Security -> Code scanning alerts

	on:
	push:
	paths:
	- '.github/workflows/**'
	- '.github/actions/**'
	pull_request:
	paths:
	- '.github/workflows/**'
	- '.github/actions/**'
	schedule:
	# Weekly full scan every Monday at 06:00 UTC - catches new CodeQL queries
	# against unchanged workflows.
	- cron: '0 6 * * 1'

	jobs:
	analyze:
	name: CodeQL - GitHub Actions SAST
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write # Required to upload SARIF results to the Security tab

	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: actions
	# Security-and-quality query suite: broader than default, surfaces
	# more workflow-hardening findings.
	queries: security-and-quality

	# No build step needed for the `actions` language - it analyzes YAML directly.

	- name: Run CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:actions"
	upload: true

Provide feedback