From 68d8ab3038abfabb227834c58c6150d635c73e5e Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 19:58:08 +0000 Subject: [PATCH] ci(codeql): scan the workflow files also The CodeQL caller scans the Rust code (`language: rust`). The workflow files of this repository (29 files) had no CodeQL scan. gitbot-fleet scans its workflow files with `language: actions`. A second job, `analyze-actions`, calls the same reusable workflow at the same pinned commit with `language: actions`. The called workflow takes 1 language for each call, and it gives each call its own result category (`/language:`), so the 2 jobs do not write to the same category. The job starts only when the Actions settings of this repository permit reusable workflows from `metadatastician/standards`, as the other callers. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .github/workflows/codeql.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fa93c7d..faf95df 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -8,6 +8,7 @@ # single-language / single-job by design — multi-language wrappers # call the reusable once per language. echidnabot is a Rust crate with no # JavaScript or TypeScript file, so this caller passes `language: rust`. +# A second job scans the workflow files (`language: actions`). name: CodeQL Security Analysis on: push: @@ -34,3 +35,11 @@ jobs: uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01 with: language: rust + analyze-actions: + permissions: + actions: read + contents: read + security-events: write + uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 + with: + language: actions