From fe3a8bd062efda60fe300bda0bba6ff5b2c46a82 Mon Sep 17 00:00:00 2001 From: Kaitlyn Date: Fri, 6 Nov 2026 02:20:20 -0500 Subject: [PATCH] docs: add the CodeQL badge and describe code scanning Code scanning now runs with GitHub's CodeQL default setup, configured in the repository settings, so the docs say where it is and what it covers. --- ARCHITECTURE.md | 4 +++- CONTRIBUTING.md | 3 ++- README.md | 1 + 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 598ffd8..a3587d3 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -359,7 +359,9 @@ Coverage counts only what `go test` runs in-process. The end-to-end tests run th they prove behavior but are not counted: `cmd/gitwhy` and `internal/ui` show 0%. Every third-party action is pinned to a full commit SHA and every tool to an exact version; Dependabot proposes the updates. `.github/workflows/check-secrets.yml` (manual) checks that the release secrets are set and -that the Homebrew token can write to the tap. +that the Homebrew token can write to the tap. GitHub code scanning (CodeQL default setup, managed +in the repository settings, so there is no workflow file) analyzes the Go code, the workflows, the +npm package and the Python scripts on every push and pull request to `main` and once a week. ## Build, release and packaging diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c82f768..aba934d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -36,7 +36,8 @@ node --test npm/lib.test.js # the npm package CI (`.github/workflows/ci.yml`) is the authority. On top of the commands above it runs `govulncheck`, `actionlint`, `shellcheck`, checks that `go.mod`/`go.sum` are tidy and that `THIRD_PARTY_LICENSES` is up to date (`scripts/third-party-licenses.sh` regenerates it), builds every release artifact with goreleaser -in snapshot mode, and builds the Nix flake. All of it must be green before a merge. +in snapshot mode, and builds the Nix flake. GitHub code scanning (CodeQL) also runs on every pull +request. All of it must be green before a merge. ### Coverage diff --git a/README.md b/README.md index 1db139a..231b05e 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,7 @@ [![ci](https://github.com/dpologdvinity/gitwhy/actions/workflows/ci.yml/badge.svg)](https://github.com/dpologdvinity/gitwhy/actions/workflows/ci.yml) [![release installs verified](https://github.com/dpologdvinity/gitwhy/actions/workflows/verify-install.yml/badge.svg)](https://github.com/dpologdvinity/gitwhy/actions/workflows/verify-install.yml) +[![CodeQL](https://github.com/dpologdvinity/gitwhy/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/dpologdvinity/gitwhy/security/code-scanning) [![latest release](https://img.shields.io/github/v/release/dpologdvinity/gitwhy)](https://github.com/dpologdvinity/gitwhy/releases/latest) [![npm](https://img.shields.io/npm/v/@kaitlynbassford/gitwhy)](https://www.npmjs.com/package/@kaitlynbassford/gitwhy) [![downloads](https://img.shields.io/github/downloads/dpologdvinity/gitwhy/total)](https://github.com/dpologdvinity/gitwhy/releases)