M6 [P2]: CodeQL scans JS/actions only — add Rust static analysis and require it on main #250

New Issue

2026-07-31T14:40:32Z

KofTwentyTwo commented

2026-07-31 14:40:32 +00:00

(Migrated from github.com)

.github/workflows/codeql.yml scans only javascript-typescript + actions; this is a pure-Rust repo, so CodeQL currently covers none of the real code, and it is not in the required-status-checks on main. Goal: point CodeQL at Rust (or add a Rust SAST such as cargo-audit/clippy-driven analysis) and add the real check to branch protection required checks on main.

Source: full-tree audit 2026-07-30 (scratchpad/audit/AUDIT-SUMMARY.md). Follow docs/STORY-WORKFLOW.md: engine+proto(if surface)+CLI+offline E2E, mock-only tests, no fabricated data, comment convention, PR to dev, PO reviews before close.

`.github/workflows/codeql.yml` scans only `javascript-typescript` + `actions`; this is a pure-Rust repo, so CodeQL currently covers none of the real code, and it is not in the required-status-checks on main. Goal: point CodeQL at Rust (or add a Rust SAST such as cargo-audit/clippy-driven analysis) and add the real check to branch protection required checks on main. Source: full-tree audit 2026-07-30 (scratchpad/audit/AUDIT-SUMMARY.md). Follow docs/STORY-WORKFLOW.md: engine+proto(if surface)+CLI+offline E2E, mock-only tests, no fabricated data, comment convention, PR to dev, PO reviews before close.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/nuncio#250