From cde98c1c38d006f4d1205009f8fccfd9a6a3f5ff Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 27 May 2026 19:03:13 +0100 Subject: [PATCH] fix(ci): close 7 real code-scanning alerts (canary for estate sweep) Adds the three missing standards reusables, pins the unpinned one, adds a CodeQL workflow scoped to GitHub Actions (the repo's only analyzable surface), and removes the stale root-level STATE.a2ml. Alerts closed: #2 workflow_audit/missing_workflow scorecard.yml #4 workflow_audit/missing_workflow mirror.yml #6 workflow_audit/missing_workflow secret-scanner.yml #7 workflow_audit/unpinned_action governance.yml @main -> @4285741 #8 cicd_rules/missing_requirement scorecard.yml (same root as #2) #10 scorecard/StaticAnalysis add codeql.yml language: actions #12 structural_drift/SD004 remove root .machine_readable/STATE.a2ml (canonical at .machine_readable/6a2/STATE.a2ml) Not addressed here: #11 git_state/GS007 non-main branch `feat/register-echotypes-krladapter` is the head of in-flight PR #16; will auto-resolve when that PR merges or closes. The 17 CSA001/CSA002/CSA003 self-referential alerts on this repo were dismissed as `won't fix` against hyperpolymath/hypatia#368, which suppresses the meta-rule lens at the SARIF render layer to stop the self-echo at source. All four wrapper workflows are pinned to standards/main HEAD SHA 4285741 (2026-05-27). Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 50 ++++++++++++++++++++++++++++ .github/workflows/governance.yml | 2 +- .github/workflows/mirror.yml | 15 +++++++++ .github/workflows/scorecard.yml | 16 +++++++++ .github/workflows/secret-scanner.yml | 19 +++++++++++ .machine_readable/STATE.a2ml | 38 --------------------- 6 files changed, 101 insertions(+), 39 deletions(-) create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/mirror.yml create mode 100644 .github/workflows/scorecard.yml create mode 100644 .github/workflows/secret-scanner.yml delete mode 100644 .machine_readable/STATE.a2ml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..6b2574f --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,50 @@ +# SPDX-License-Identifier: MPL-2.0 +# Analyses the GitHub Actions workflows in this repo. This is a Julia +# package registry: source content is TOML and the only executable +# surface is the workflows themselves -- so `language: actions` is the +# matrix that produces meaningful SAST results (closing the +# `scorecard/StaticAnalysis` nominal-SAST finding). +name: CodeQL Security Analysis + +on: + push: + branches: [main, master] + pull_request: + branches: [main, master] + schedule: + - cron: '0 6 * * 1' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + analyze: + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + strategy: + fail-fast: false + matrix: + include: + - language: actions + build-mode: none + + steps: + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Initialize CodeQL + uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3 + with: + category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 4bb50e9..5e89144 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -31,4 +31,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml new file mode 100644 index 0000000..4880045 --- /dev/null +++ b/.github/workflows/mirror.yml @@ -0,0 +1,15 @@ +# SPDX-License-Identifier: MPL-2.0-or-later +name: Mirror to Git Forges + +on: + push: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +jobs: + mirror: + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 + secrets: inherit diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..e40bd25 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: MPL-2.0 +name: Scorecards supply-chain security + +on: + branch_protection_rule: + schedule: + - cron: '23 4 * * 1' + push: + branches: [main] + +permissions: read-all + +jobs: + analysis: + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 + secrets: inherit diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml new file mode 100644 index 0000000..9bdf984 --- /dev/null +++ b/.github/workflows/secret-scanner.yml @@ -0,0 +1,19 @@ +# SPDX-License-Identifier: MPL-2.0-or-later +name: Secret Scanner + +on: + pull_request: + push: + branches: [main] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + scan: + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@42857410898a9f0e3ecae8778cb2c65f7975a260 + secrets: inherit diff --git a/.machine_readable/STATE.a2ml b/.machine_readable/STATE.a2ml deleted file mode 100644 index 9260711..0000000 --- a/.machine_readable/STATE.a2ml +++ /dev/null @@ -1,38 +0,0 @@ -; SPDX-License-Identifier: PMPL-1.0-or-later -; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -(state - (metadata - (version "1.0") - (updated "2026-04-04") - (crg-grade "C")) - - (project-context - (name "HyperpolymathRegistry") - (type "julia-package-registry") - (purpose "Custom Julia package registry for all hyperpolymath Julia packages") - (status "stable")) - - (current-position - (completion-percentage 95) - (recent-achievement "Implemented CRG Grade C test suite") - (test-status "all-passing") - (package-count 50)) - - (route-to-mvp - (phases - (("Phase 1" "Registry infrastructure setup" "COMPLETE")) - (("Phase 2" "Package registration (50+ packages)" "COMPLETE")) - (("Phase 3" "Test coverage to Grade C" "COMPLETE")))) - - (blockers-and-issues - (active-blockers ()) - (resolved-issues - ("Test coverage added" "2026-04-04"))) - - (critical-next-actions - (next "Monitor package submissions") - (next "Maintain registry compatibility with Julia package manager")) - - (session-history - (("2026-04-04" "Added CRG C test suite (20 tests, all passing)"))))