From b41cf7e017c3c0048c8e2e72329e4f9f9a8802c9 Mon Sep 17 00:00:00 2001 From: Nelson Dominguez Date: Thu, 8 Oct 2026 11:18:26 +0200 Subject: [PATCH 1/5] test: inspect CodeQL SARIF findings --- .github/workflows/codeql.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7c9e73a..bfee43f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,3 +36,9 @@ jobs: - src - scripts - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 + with: + output: codeql-results + - name: Show CodeQL findings (temporary) + run: | + find codeql-results -name '*.sarif' -type f -print0 | + xargs -0 -r jq -r '.runs[] | .results[]? | [.ruleId, (.locations[0].physicalLocation.artifactLocation.uri // ""), ((.locations[0].physicalLocation.region.startLine // 0) | tostring), (.message.text // "")] | @tsv' From 4e848725b547df0e331018425a064f372a6a6bcf Mon Sep 17 00:00:00 2001 From: Nelson Dominguez Date: Thu, 8 Oct 2026 11:20:06 +0200 Subject: [PATCH 2/5] test: inspect results without uploading duplicate CodeQL analysis --- .github/workflows/codeql.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index bfee43f..093d4de 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,6 +38,7 @@ jobs: - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: output: codeql-results + upload: never - name: Show CodeQL findings (temporary) run: | find codeql-results -name '*.sarif' -type f -print0 | From 21146d2a8db5acb5fa6ac2bc3acc8b50d75a833b Mon Sep 17 00:00:00 2001 From: Nelson Dominguez Date: Thu, 8 Oct 2026 11:21:31 +0200 Subject: [PATCH 3/5] test: inspect full-repository CodeQL results --- .github/workflows/codeql.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 093d4de..5eebd3d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,10 +31,6 @@ jobs: with: languages: javascript-typescript build-mode: none - config: | - paths: - - src - - scripts - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 with: output: codeql-results From 6b779b80e3197f80ccce6c414e55d95832a2cbce Mon Sep 17 00:00:00 2001 From: Nelson Dominguez Date: Thu, 8 Oct 2026 11:26:17 +0200 Subject: [PATCH 4/5] fix: scan first-party code without generated vendor bundles --- .github/workflows/codeql.yml | 16 +++++++--------- SECURITY.md | 4 ++++ test/package.test.ts | 19 +++++++++++++++++++ 3 files changed, 30 insertions(+), 9 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5eebd3d..1db0077 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -3,9 +3,9 @@ name: CodeQL on: push: branches: [main] - paths: ['src/**', 'scripts/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml'] + paths: ['src/**', 'scripts/**', 'test/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml'] pull_request: - paths: ['src/**', 'scripts/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml'] + paths: ['src/**', 'scripts/**', 'test/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml'] workflow_dispatch: permissions: @@ -31,11 +31,9 @@ jobs: with: languages: javascript-typescript build-mode: none + config: | + paths: + - src + - scripts + - test - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4 - with: - output: codeql-results - upload: never - - name: Show CodeQL findings (temporary) - run: | - find codeql-results -name '*.sarif' -type f -print0 | - xargs -0 -r jq -r '.runs[] | .results[]? | [.ruleId, (.locations[0].physicalLocation.artifactLocation.uri // ""), ((.locations[0].physicalLocation.region.startLine // 0) | tostring), (.message.text // "")] | @tsv' diff --git a/SECURITY.md b/SECURITY.md index d78b27d..ad411c9 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -31,6 +31,10 @@ gh attestation verify setup-zig-v1.0.0.tar.gz -R ekkolon/setup-zig \ The release also provides `sbom.cdx.json` and `SHA256SUMS`. The `v1` major tag intentionally moves to compatible releases; pin a full action commit SHA or an immutable version tag when evaluating a fixed dependency. Attestations identify the publishing workflow and artifacts, but do not certify that the code is vulnerability-free or compliant with a particular standard. +## Code scanning + +CodeQL analyzes maintained source in `src/`, `scripts/`, and `test/`. The generated `dist/` bundles include third-party libraries; CI checks that they reproduce from the lockfile and audits dependencies, including build tools. Review findings in bundled code against their upstream context before treating them as vulnerabilities. + ## Runner and cache trust GitHub's normal cache access rules apply. Build caches contain unsigned compiler output and packages, so treat them as workflow data. Use `cache: false` for jobs that must rebuild without restored build data. `cache-read-only` prevents this action from uploading caches; it does not make restored data trusted. diff --git a/test/package.test.ts b/test/package.test.ts index e281194..2084d1e 100644 --- a/test/package.test.ts +++ b/test/package.test.ts @@ -82,3 +82,22 @@ test('releases require immutability and attest their archive and SBOM', async () assert.ok(immutabilityCheck > publishScript.indexOf('gh release create')); assert.ok(immutabilityCheck < publishScript.indexOf('major=')); }); + + +test('CodeQL checks maintained source rather than generated bundles', async () => { + const workflow = parse( + await readFile('.github/workflows/codeql.yml', 'utf8'), + ); + const steps = workflow.jobs.analyze.steps; + const init = steps.find((step: {uses?: string}) => + step.uses?.startsWith('github/codeql-action/init@'), + ); + const config = parse(init.with.config); + assert.deepEqual(config.paths, ['src', 'scripts', 'test']); + assert.ok(!config.paths.includes('dist')); + assert.ok( + steps.some((step: {uses?: string}) => + step.uses?.startsWith('github/codeql-action/analyze@'), + ), + ); +}); From 5732d1d1ecb8228a8d6d25444deb3610ad2eb23a Mon Sep 17 00:00:00 2001 From: Nelson Dominguez Date: Thu, 8 Oct 2026 11:27:01 +0200 Subject: [PATCH 5/5] style: format CodeQL coverage test --- test/package.test.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/test/package.test.ts b/test/package.test.ts index 2084d1e..9bdffc5 100644 --- a/test/package.test.ts +++ b/test/package.test.ts @@ -83,7 +83,6 @@ test('releases require immutability and attest their archive and SBOM', async () assert.ok(immutabilityCheck < publishScript.indexOf('major=')); }); - test('CodeQL checks maintained source rather than generated bundles', async () => { const workflow = parse( await readFile('.github/workflows/codeql.yml', 'utf8'),