james.maes
3dd5adf89d
Generate an offline setup plan, require successful current bootstrap PR checks before applying settings, bind contexts to GitHub Actions, and validate readback. Preserve conflicting existing protections and stop instead of replacing them. Propagate the tested human-acknowledged review gate and locked JavaScript tooling to generated apps, including custom owner replacement and CodeQL coverage. Exclude node_modules and worktree metadata from template packages. Document owner bootstrap, least-privilege settings and the remaining live proof. Validation: 13 setup and four coverage Pester tests, seven review Node tests, PowerShell analysis, ESLint, workflow/security/documentation lint. npm verifies 83 signatures and 20 attestations. Actual packed CLI/no-CLI variants generate correct owners and reviewers and pass locked restores and zero-warning builds. Live repository provisioning requires authorized creation/push and hosted CI. Refs: KofTwentyTwo/AppKit#10, KofTwentyTwo/AppKit#13, KofTwentyTwo/AppKit#7, KofTwentyTwo/AppKit#9, KofTwentyTwo/AppKit#20 Co-Authored-By: Codex (GPT-6) <noreply@openai.com> Signed-off-by: James Maes <james@kof22.com>
32 lines
925 B
YAML
32 lines
925 B
YAML
# CodeQL static analysis (K22-CI-22): security-extended queries for C# (a manual x64
|
|
# build of the solution) and for the workflows themselves, blocking high severity.
|
|
name: codeql
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: "41 6 * * 1"
|
|
|
|
workflow_call:
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
codeql:
|
|
uses: KofTwentyTwo/standards/.github/workflows/codeql.yml@fdf5ed029603c938615a32b1beca3628b8787945 # v0.1.2
|
|
permissions:
|
|
contents: read # check out the code
|
|
security-events: write # upload CodeQL results to code scanning
|
|
with:
|
|
languages: '["csharp", "actions", "javascript-typescript"]'
|
|
build-mode: manual
|
|
build-command: dotnet build Kof22App.slnx -p:Platform=x64
|
|
runs-on: windows-latest
|
|
setup-dotnet: true
|