Skip to content

[CI]: Add CodeQL SAST, Dependabot config, and OSSF Scorecard workflow - #10

Merged
Spencer Schoenberg (spencrr) merged 2 commits into
mainfrom
spencrr/ci
Apr 22, 2026
Merged

[CI]: Add CodeQL SAST, Dependabot config, and OSSF Scorecard workflow#10
Spencer Schoenberg (spencrr) merged 2 commits into
mainfrom
spencrr/ci

Conversation

@spencrr

@spencrr Spencer Schoenberg (spencrr) commented Apr 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description

Add CodeQL SAST analysis, Dependabot dependency management, and OSSF Scorecard
supply-chain security workflow.

CodeQL (.github/workflows/codeql.yml):

  • Runs on push to main, PRs targeting main, and weekly (Wednesdays 14:25 UTC)
  • Python language analysis with pinned action SHAs (actions/checkout@v6.0.2,
    github/codeql-action@v4.35.1)
  • Minimal permissions scoped to actions: read, contents: read, security-events: write

Dependabot (.github/dependabot.yml):

  • Weekly update checks for uv, GitHub Actions, pre-commit, Docker, docker-compose,
    and devcontainers ecosystems
  • Commit messages prefixed with [MAINT] per repo convention
  • Minor/patch updates grouped for uv to reduce PR noise

OSSF Scorecard (.github/workflows/scorecard.yml):

  • Runs on push to main, PRs, and weekly (Saturdays 06:30 UTC)
  • Uploads SARIF results to GitHub code scanning dashboard
  • Pinned to ossf/scorecard-action@v2.4.3

All workflows use persist-credentials: false and empty default permissions: {}
following security best practices.

Breaking changes

None

Checklist

  • pre-commit run --all-files passes
  • Tests added or updated for changes
  • Documentation updated

@spencrr
Spencer Schoenberg (spencrr) changed the base branch from main to spencrr/project-metadata April 14, 2026 02:37
@spencrr
Spencer Schoenberg (spencrr) changed the base branch from spencrr/project-metadata to spencrr/workflows April 14, 2026 02:37
@spencrr Spencer Schoenberg (spencrr) changed the title spencrr/ci [CI]: Add CodeQL SAST, Dependabot config, and OSSF Scorecard workflow Apr 14, 2026
This was referenced Apr 17, 2026
Merged
Merged
@spencrr
Spencer Schoenberg (spencrr) marked this pull request as ready for review April 17, 2026 22:20
nina-msft
Nina Chikanov (nina-msft) reviewed Apr 20, 2026
View reviewed changes
Comment thread .github/workflows/codeql.yml Outdated
nina-msft
Nina Chikanov (nina-msft) reviewed Apr 20, 2026
View reviewed changes
Comment thread .github/dependabot.yml
nina-msft
Nina Chikanov (nina-msft) reviewed Apr 20, 2026
View reviewed changes
Comment thread .github/dependabot.yml Outdated
nina-msft
Nina Chikanov (nina-msft) approved these changes Apr 20, 2026
View reviewed changes

@nina-msft Nina Chikanov (nina-msft) left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM after comments are addressed :)

This was referenced Apr 21, 2026
Merged
Merged
@spencrr
Spencer Schoenberg (spencrr) force-pushed the spencrr/workflows branch 2 times, most recently from 22f6e11 to 26e80ba Compare April 21, 2026 00:40
@spencrr
Spencer Schoenberg (spencrr) requested a review from a team as a code owner April 21, 2026 21:29
@spencrr
Spencer Schoenberg (spencrr) changed the base branch from spencrr/workflows to main April 22, 2026 01:37
@spencrr
Spencer Schoenberg (spencrr) merged commit a065d12 into main Apr 22, 2026
3 checks passed
@spencrr
Spencer Schoenberg (spencrr) deleted the spencrr/ci branch April 22, 2026 04:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nina-msft Nina Chikanov (nina-msft) nina-msft approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@spencrr @nina-msft