Repository navigation
S0269-dates-drift-check-phase-2: call the org CodeQL reusable - #5
Merged
Merged
Conversation
Closes the one drift config/drift-manifest.json measures against this repo: the light baseline's securityWorkflows group requires codeql.yml beside scorecard.yml, and only scorecard.yml was here. A thin caller, like scorecard.yml, so the analysis stays defined once in cosyte/.github. The job grants security-events: write, contents: read and actions: read because a called workflow can only downgrade its caller's token, and it names the published reference workflows-2026-09-04-f29e9cc83cac rather than @main so nothing in cosyte/.github reaches this repo until this line is edited.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the single drift
config/drift-manifest.jsonmeasures against this repo.The
lightbaseline'ssecurityWorkflowsgroup requirescodeql.ymlandscorecard.yml. This repo carriedscorecard.yml,ci.ymlandno-emdash.yml, and was missingcodeql.ymlalone. Before this changenode config/scripts/drift-check.jsprinted:After it:
with no
datesrow underWORKLIST.What this is
One new file,
.github/workflows/codeql.yml, a thin caller of the orgreusable in
cosyte/.github, in the same shape as thescorecard.ymlcaller already in this repo. Nothing else is added, modified or deleted.
Two things about the caller worth reading rather than skimming:
downgrade its caller's token, never escalate it, so
security-events: write,contents: readandactions: readhave to be granted here orGitHub rejects the workflow at startup, before a step runs.
.github/CI.mdalready recorded the same three under the section onreusables this repo did not call yet.
@main, which departs fromscorecard.yml.workflows-2026-09-04-f29e9cc83cacresolves to commitf29e9cc83cac4bd5fc73a68cefa22f136cd39608and never names another, so nolater change in
cosyte/.githubreaches this repo until this line isedited. Both that repo's README and the header of the reusable itself ask
callers for this form.
One-way door, declared
cosyte/datesis a public repository and this workflow uploads a SARIFanalysis into its Security tab. Deleting the file later stops new analyses;
it does not retract an alert history already written. Accepted, on the same
axis
scorecard.ymlrecords for itspublish-results: falsechoice.Spec:
work/specs/S0269-dates-drift-check-phase-2/spec.mdin the umbrella.