ci: CodeQL, Docker image digests, jq for the Codemod token (#148)

.github/workflows/codemod.yml

@@ -133,6 +133,6 @@ jobs:
           node-version: '24'
       - run: npm install -g codemod@1.18.5
       - run: |
-          token=$(curl -sSf -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=https://app.codemod.com" | node -p 'JSON.parse(require("fs").readFileSync(0)).value')
+          token=$(curl -sSf -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=https://app.codemod.com" | jq -r .value)
           echo "::add-mask::$token"
           CODEMOD_AUTH_TOKEN=$token codemod publish registry

.github/workflows/codeql.yml

@@ -0,0 +1,27 @@
+name: codeql
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '41 4 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: CodeQL
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee

codemod/test/fixtures/pnpm-monorepo/docs/Dockerfile

@@ -1 +1 @@
-FROM node:18
+FROM node:18@sha256:c6ae79e38498325db67193d391e6ec1d224d96c693a8a4d943498556716d3783

codemod/test/fixtures/pnpm-monorepo/packages/db/Dockerfile

@@ -1,2 +1,2 @@
-FROM node:20-alpine
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293
 COPY . .

tests-startup/Dockerfile

@@ -1,6 +1,5 @@
-# Both versions can be overridden with --build-arg; use supported matrix versions.
-ARG POSTGRES_VERSION=17.11
-FROM postgres:${POSTGRES_VERSION}-bookworm
+ARG POSTGRES_IMAGE=postgres:17.11-bookworm@sha256:3645570cccdfa447589da9f57dd740faa29b30938e861289a5574b6ca6b03826
+FROM ${POSTGRES_IMAGE}
 ARG NODE_VERSION=24.21.0
 RUN apt-get update \
     && apt-get install -y --no-install-recommends ca-certificates curl openssl xz-utils coreutils libatomic1 \

tests-startup/README.md

@@ -45,7 +45,7 @@ to Node 24.21.0 and PostgreSQL 17.11, both within the existing CI matrix:
 
 ```sh
 docker build -f tests-startup/Dockerfile \
-  --build-arg NODE_VERSION=24.21.0 --build-arg POSTGRES_VERSION=17.11 \
+  --build-arg NODE_VERSION=24.21.0 --build-arg POSTGRES_IMAGE=postgres:17.11-bookworm \
   -t postgresjs-startup-tests .
 docker run --rm --network none -v "$PWD:/repo:ro" postgresjs-startup-tests
 ```