From 99b3fb4e19d9e2f712b628d7ed21072527eb4de1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Torbj=C3=B8rn=20B=C3=B8e=20Lauvvik?= Date: Tue, 10 Nov 2026 14:58:00 +0100 Subject: [PATCH 1/2] ci: add CodeQL analysis (shared workflow) Adds CodeQL code scanning through the shared reusable workflow in OriginAS/origin-actions (push to the default branch, pull requests, monthly schedule, manual dispatch). security-events: write is granted only to the analyze job. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/codeql-caller.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/workflows/codeql-caller.yml diff --git a/.github/workflows/codeql-caller.yml b/.github/workflows/codeql-caller.yml new file mode 100644 index 0000000..877b365 --- /dev/null +++ b/.github/workflows/codeql-caller.yml @@ -0,0 +1,29 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + schedule: + - cron: '0 5 1 * *' # monthly, 1st at 05:00 UTC + workflow_dispatch: + +concurrency: + group: codeql-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + analyze: + # Without the event_name check the job is skipped on push/schedule: + # github.event.pull_request.draft is null there. + if: github.event_name != 'pull_request' || github.event.pull_request.draft == false + permissions: + actions: read + contents: read + security-events: write + uses: OriginAS/origin-actions/.github/workflows/codeql.yml@main + secrets: inherit From c88896e9e93d74df4c8726e6e852748d4d3ea944 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Torbj=C3=B8rn=20B=C3=B8e=20Lauvvik?= Date: Tue, 10 Nov 2026 18:26:07 +0100 Subject: [PATCH 2/2] ci: call the CodeQL workflow through a local ref A local ./.github/workflows/ ref runs the reusable workflow from the same commit as the caller, so it is pinned and needs no SHA updates. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/codeql-caller.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql-caller.yml b/.github/workflows/codeql-caller.yml index 877b365..3fdfa87 100644 --- a/.github/workflows/codeql-caller.yml +++ b/.github/workflows/codeql-caller.yml @@ -25,5 +25,5 @@ jobs: actions: read contents: read security-events: write - uses: OriginAS/origin-actions/.github/workflows/codeql.yml@main + uses: ./.github/workflows/codeql.yml secrets: inherit