From 350292962e7e58c846d446936efac786ea70c510 Mon Sep 17 00:00:00 2001 From: Oleg Komarov Date: Sun, 18 Oct 2026 15:42:57 +0100 Subject: [PATCH] ci: run CodeQL, pin Docker images by digest and parse the Codemod token with jq Scorecard's SAST, Pinned-Dependencies and download-then-run checks. The startup Dockerfile takes the whole image reference as POSTGRES_IMAGE, so the default is pinned and another version is still one build argument. The fixture Dockerfiles keep their Node versions; the detector's FROM pattern already reads node:18 before a digest. --- .github/workflows/codemod.yml | 2 +- .github/workflows/codeql.yml | 27 +++++++++++++++++++ .../fixtures/pnpm-monorepo/docs/Dockerfile | 2 +- .../pnpm-monorepo/packages/db/Dockerfile | 2 +- tests-startup/Dockerfile | 5 ++-- tests-startup/README.md | 2 +- 6 files changed, 33 insertions(+), 7 deletions(-) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codemod.yml b/.github/workflows/codemod.yml index a5739149..788b89b8 100644 --- a/.github/workflows/codemod.yml +++ b/.github/workflows/codemod.yml @@ -133,6 +133,6 @@ jobs: node-version: '24' - run: npm install -g codemod@1.18.5 - run: | - token=$(curl -sSf -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=https://app.codemod.com" | node -p 'JSON.parse(require("fs").readFileSync(0)).value') + token=$(curl -sSf -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=https://app.codemod.com" | jq -r .value) echo "::add-mask::$token" CODEMOD_AUTH_TOKEN=$token codemod publish registry diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..d8b1ec73 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,27 @@ +name: codeql + +on: + push: + branches: [main] + pull_request: + schedule: + - cron: '41 4 * * 1' + +permissions: + contents: read + +jobs: + analyze: + name: CodeQL + runs-on: ubuntu-24.04 + timeout-minutes: 15 + permissions: + security-events: write + steps: + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 + with: + persist-credentials: false + - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee + with: + languages: javascript-typescript + - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee diff --git a/codemod/test/fixtures/pnpm-monorepo/docs/Dockerfile b/codemod/test/fixtures/pnpm-monorepo/docs/Dockerfile index f05b8692..2fe6d717 100644 --- a/codemod/test/fixtures/pnpm-monorepo/docs/Dockerfile +++ b/codemod/test/fixtures/pnpm-monorepo/docs/Dockerfile @@ -1 +1 @@ -FROM node:18 +FROM node:18@sha256:c6ae79e38498325db67193d391e6ec1d224d96c693a8a4d943498556716d3783 diff --git a/codemod/test/fixtures/pnpm-monorepo/packages/db/Dockerfile b/codemod/test/fixtures/pnpm-monorepo/packages/db/Dockerfile index ac466d43..7ccf8231 100644 --- a/codemod/test/fixtures/pnpm-monorepo/packages/db/Dockerfile +++ b/codemod/test/fixtures/pnpm-monorepo/packages/db/Dockerfile @@ -1,2 +1,2 @@ -FROM node:20-alpine +FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 COPY . . diff --git a/tests-startup/Dockerfile b/tests-startup/Dockerfile index a3ec8043..bd2af93d 100644 --- a/tests-startup/Dockerfile +++ b/tests-startup/Dockerfile @@ -1,6 +1,5 @@ -# Both versions can be overridden with --build-arg; use supported matrix versions. -ARG POSTGRES_VERSION=17.11 -FROM postgres:${POSTGRES_VERSION}-bookworm +ARG POSTGRES_IMAGE=postgres:17.11-bookworm@sha256:3645570cccdfa447589da9f57dd740faa29b30938e861289a5574b6ca6b03826 +FROM ${POSTGRES_IMAGE} ARG NODE_VERSION=24.21.0 RUN apt-get update \ && apt-get install -y --no-install-recommends ca-certificates curl openssl xz-utils coreutils libatomic1 \ diff --git a/tests-startup/README.md b/tests-startup/README.md index 62552f24..54911abb 100644 --- a/tests-startup/README.md +++ b/tests-startup/README.md @@ -45,7 +45,7 @@ to Node 24.21.0 and PostgreSQL 17.11, both within the existing CI matrix: ```sh docker build -f tests-startup/Dockerfile \ - --build-arg NODE_VERSION=24.21.0 --build-arg POSTGRES_VERSION=17.11 \ + --build-arg NODE_VERSION=24.21.0 --build-arg POSTGRES_IMAGE=postgres:17.11-bookworm \ -t postgresjs-startup-tests . docker run --rm --network none -v "$PWD:/repo:ro" postgresjs-startup-tests ```