james.maesandCodex
36886cbaae
Pin reusable workflows to published standards 0.1.2. Require tagged commits on main, rerun the main quality and security gates before release, and fail preflight when NuGet publishing configuration is missing. Add pinned pre-commit hooks, JavaScript lint and dependency verification, PowerShell analysis and coverage-gate regression tests, and a trusted current-commit review-record check. Document the single-maintainer limitations and the unfinished OpenSSF assessment without claiming certification. Validation: seven Node and four Pester tests passed, lint and workflow checks passed, and 83 npm registry signatures plus 20 attestations verified. Full AppKit build, unit coverage and UI gates passed. Live check enforcement and owner attestations remain tracked follow-up work. Refs: #4, #6, #7, #8, #13, #15, #18 Co-Authored-By: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>
31 lines
922 B
YAML
31 lines
922 B
YAML
# CodeQL static analysis (K22-CI-22): security-extended queries for C# (a manual x64
|
|
# build of the solution) and for the workflows themselves, blocking high severity.
|
|
name: codeql
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: "41 6 * * 1"
|
|
workflow_call:
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
codeql:
|
|
uses: KofTwentyTwo/standards/.github/workflows/codeql.yml@fdf5ed029603c938615a32b1beca3628b8787945 # v0.1.2
|
|
permissions:
|
|
contents: read # check out the code
|
|
security-events: write # upload CodeQL results to code scanning
|
|
with:
|
|
languages: '["csharp", "actions", "javascript-typescript"]'
|
|
build-mode: manual
|
|
build-command: dotnet build AppKit.slnx -p:Platform=x64
|
|
runs-on: windows-latest
|
|
setup-dotnet: true
|