From 19d13336c40907ec1d075775e640af340ef205f1 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:35:45 -0400 Subject: [PATCH 1/9] ci: add enterprise automation baseline --- .github/workflows/security.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..1e0dcaa --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,18 @@ +name: Security +on: + push: + pull_request: + schedule: [{cron: '41 4 * * 1'}] +permissions: {contents: read, security-events: write} +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: {fetch-depth: 0} + - uses: gitleaks/gitleaks-action@v2 + - uses: aquasecurity/trivy-action@master + with: {scan-type: fs, scan-ref: ., format: sarif, output: trivy-results.sarif, ignore-unfixed: true, severity: HIGH,CRITICAL, exit-code: '1'} + - uses: github/codeql-action/upload-sarif@v3 + if: always() + with: {sarif_file: trivy-results.sarif} From 36a30794a2abc5a475bf1e332f488983fe7918ac Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:36:23 -0400 Subject: [PATCH 2/9] ci: add enterprise automation baseline --- .github/workflows/codeql.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..44228ac --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,15 @@ +name: CodeQL +on: + push: + pull_request: + schedule: [{cron: '23 3 * * 1'}] +permissions: {contents: read, security-events: write} +jobs: + analyze: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: github/codeql-action/init@v3 + with: {languages: python, javascript-typescript, go, rust, java-kotlin, c-cpp} + - uses: github/codeql-action/autobuild@v3 + - uses: github/codeql-action/analyze@v3 From 3553fce43438c27345f1924e0377bb57489b87c3 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:36:37 -0400 Subject: [PATCH 3/9] ci: add enterprise automation baseline --- .github/workflows/dependency-review.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..52a13f9 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,9 @@ +name: Dependency Review +on: {pull_request:} +permissions: {contents: read, pull-requests: read} +jobs: + review: + runs-on: ubuntu-latest + steps: + - uses: actions/dependency-review-action@v4 + with: {fail-on-severity: high} From 403d2c5e37b1f30c995995c4d752fb1c0ad45ba8 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 19:36:55 -0400 Subject: [PATCH 4/9] ci: add enterprise automation baseline --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..aac8031 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: {interval: weekly} + open-pull-requests-limit: 10 From b2b1a0771f04c76a7b99ad277fcd549b4b41399b Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 20:08:10 -0400 Subject: [PATCH 5/9] ci: validate CodeQL language YAML --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 44228ac..ad868d5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,6 +10,6 @@ jobs: steps: - uses: actions/checkout@v4 - uses: github/codeql-action/init@v3 - with: {languages: python, javascript-typescript, go, rust, java-kotlin, c-cpp} + with: {languages: 'python,javascript-typescript,go,rust,java-kotlin,c-cpp'} - uses: github/codeql-action/autobuild@v3 - uses: github/codeql-action/analyze@v3 From 741b1092d1b8f5fdc817d8e5158b7700ed712195 Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Thu, 23 Jul 2026 20:08:39 -0400 Subject: [PATCH 6/9] ci: validate Trivy severity YAML --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 1e0dcaa..a05394f 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -12,7 +12,7 @@ jobs: with: {fetch-depth: 0} - uses: gitleaks/gitleaks-action@v2 - uses: aquasecurity/trivy-action@master - with: {scan-type: fs, scan-ref: ., format: sarif, output: trivy-results.sarif, ignore-unfixed: true, severity: HIGH,CRITICAL, exit-code: '1'} + with: {scan-type: fs, scan-ref: ., format: sarif, output: trivy-results.sarif, ignore-unfixed: true, severity: 'HIGH,CRITICAL', exit-code: '1'} - uses: github/codeql-action/upload-sarif@v3 if: always() with: {sarif_file: trivy-results.sarif} From 6535243febc07d43486030de5c6dbb137fbbd1ce Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:17:30 -0400 Subject: [PATCH 7/9] ci: detect CodeQL languages per repository --- .github/workflows/codeql.yml | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ad868d5..e1525a4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,14 +2,43 @@ name: CodeQL on: push: pull_request: - schedule: [{cron: '23 3 * * 1'}] -permissions: {contents: read, security-events: write} + schedule: + - cron: '23 3 * * 1' +permissions: + contents: read + security-events: write jobs: + detect: + runs-on: ubuntu-latest + outputs: + languages: ${{ steps.lang.outputs.languages }} + steps: + - uses: actions/checkout@v4 + - id: lang + shell: bash + run: | + langs='' + find . -name '*.py' -print -quit | grep -q . && langs="$langs python" + find . ( -name '*.js' -o -name '*.ts' -o -name '*.tsx' ) -print -quit | grep -q . && langs="$langs javascript-typescript" + [ -f go.mod ] && langs="$langs go" + [ -f Cargo.toml ] && langs="$langs rust" + [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" + find . ( -name '*.c' -o -name '*.cpp' -o -name '*.h' ) -print -quit | grep -q . && langs="$langs c-cpp" + [ -n "$langs" ] || langs=' python' + langs="${langs# }" + echo "languages=$(printf '%s +' $langs | jq -Rsc 'split("\n")[:-1]')" >> "$GITHUB_OUTPUT" analyze: + needs: detect + strategy: + fail-fast: false + matrix: + language: ${{ fromJSON(needs.detect.outputs.languages) }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: github/codeql-action/init@v3 - with: {languages: 'python,javascript-typescript,go,rust,java-kotlin,c-cpp'} + with: + languages: ${{ matrix.language }} - uses: github/codeql-action/autobuild@v3 - uses: github/codeql-action/analyze@v3 From 04ef0779b7e21f540b4e3bd549d9bbc17853402d Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:22:40 -0400 Subject: [PATCH 8/9] ci: harden CodeQL language detection --- .github/workflows/codeql.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e1525a4..b3f48b1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -17,17 +17,18 @@ jobs: - id: lang shell: bash run: | + set -euo pipefail langs='' - find . -name '*.py' -print -quit | grep -q . && langs="$langs python" - find . ( -name '*.js' -o -name '*.ts' -o -name '*.tsx' ) -print -quit | grep -q . && langs="$langs javascript-typescript" + [ -n "$(find . -name '*.py' -print -quit)" ] && langs="$langs python" + [ -n "$(find . -name '*.js' -print -quit)" ] || [ -n "$(find . -name '*.ts' -print -quit)" ] && langs="$langs javascript-typescript" [ -f go.mod ] && langs="$langs go" [ -f Cargo.toml ] && langs="$langs rust" [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" - find . ( -name '*.c' -o -name '*.cpp' -o -name '*.h' ) -print -quit | grep -q . && langs="$langs c-cpp" + [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp" [ -n "$langs" ] || langs=' python' - langs="${langs# }" - echo "languages=$(printf '%s -' $langs | jq -Rsc 'split("\n")[:-1]')" >> "$GITHUB_OUTPUT" + json="$(printf '%s\n' $langs | jq -Rsc 'split(" +") | map(select(length > 0))')" + echo "languages=$json" >> "$GITHUB_OUTPUT" analyze: needs: detect strategy: From d7f9f7b674eeebd1a5a3b7e95b732ffb22655e8e Mon Sep 17 00:00:00 2001 From: Corey Leath Date: Fri, 24 Jul 2026 09:30:14 -0400 Subject: [PATCH 9/9] ci: fix CodeQL language JSON generation --- .github/workflows/codeql.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b3f48b1..f6a1ed3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,8 +26,7 @@ jobs: [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin" [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp" [ -n "$langs" ] || langs=' python' - json="$(printf '%s\n' $langs | jq -Rsc 'split(" -") | map(select(length > 0))')" + json="$(jq -cn --arg l "$langs" '$l | split(" ") | map(select(length > 0))')" echo "languages=$json" >> "$GITHUB_OUTPUT" analyze: needs: detect