ci: pin more dependencies and configure CodeQL checks - #11777
Merged
Conversation
Improves the OpenSSF Scorecard Pinned-Dependencies check:
- docker/Dockerfile.base: give build_image/base_image pinned digest
defaults and reference them as ${...} so scorecard resolves the FROM
images by hash (containerImage 1/3 -> 3/3). docker-bake.hcl still
overrides them at build time.
- workflows_linting.yml: pin actionlint to v1.7.12 instead of @latest
(goCommand 0/1 -> 1/1; scorecard treats full semver as pinned).
- docs_search_sync.yml: use `npm ci` instead of `npm install` so the
install verifies the committed lockfile (npmCommand 0/1 -> 1/1).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Adds a committed CodeQL workflow (advanced setup) that runs on push and pull_request to main plus a weekly schedule, so the OpenSSF Scorecard SAST check reliably credits CodeQL via both its workflow-config and runs-on-commits probes. GitHub's "default setup" has no workflow file and is not consistently detected (see ossf/scorecard#3817). Action versions are SHA-pinned and kept fresh by Dependabot. Note: CodeQL default setup must be disabled in repo settings before merging, since GitHub does not allow default and advanced setup together. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
julian-risch
changed the title
julian-risch
marked this pull request as ready for review
June 25, 2026 14:50
Addresses review feedback: - codeql.yml: add a concurrency group (cancel superseded runs) and timeout-minutes: 360 as a guard against a hung analysis. - codeql.yml: bump github/codeql-action from v3.27.0 to v3.36.2 (still SHA-pinned; kept fresh by Dependabot's github-actions updater). - dependabot.yml: correct the docker comment -- Dependabot does not parse images that reach FROM via an ARG, so the build_image/base_image ARG defaults in Dockerfile.base are not auto-tracked and must be bumped by hand and kept in sync with docker/docker-bake.hcl. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Keeps github/codeql-action pinned to the same commit across both workflows so Dependabot bumps them together. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
davidsbatista
approved these changes
Jun 25, 2026
julian-risch
enabled auto-merge (squash)
June 25, 2026 15:39
6 tasks
This was referenced Jul 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues
Proposed Changes:
docker/Dockerfile.baseby digest via${...}args (containerImage 1/3 → 3/3), pinactionlinttov1.7.12(go 0/1 → 1/1), and usenpm ciindocs_search_sync.yml(npm 0/1 → 1/1).How did you test it?
Notes for the reviewer
Checklist
ci:).Release note— N/A (CI-only, not user-facing).Unit tests— N/A (CI configuration only).