[Kshot3000]

Closes #298

What this adds

Dependabot already covers dependency alerts here, but nothing scans the code itself. This adds the CodeQL workflow #298 proposes, so static analysis covers the website's JavaScript/TypeScript alongside it.

.github/workflows/codeql.yml:

• Analyses javascript-typescript with build-mode: none — CodeQL extracts JS/TS directly from source, so no build step is needed and the Docusaurus site in website/ is covered as-is.
• Runs on push to main, on pull requests targeting main, and weekly on a schedule (Mondays 06:30 UTC), matching the proposal.
• Uses the current action majors — actions/checkout@v6, as the existing workflows here do, and github/codeql-action@v4 (init + analyze).
• Least-privilege permissions: contents: read at the top level; the analyze job adds only what uploading results requires (security-events: write, plus packages: read / actions: read per the CodeQL template).

TRIAGE.md gains a short "Security scanning" section, per the issue's third acceptance item: Dependabot and CodeQL, where each one's results appear (Security → Dependabot / Security → Code scanning), and a note that Security-labelled items are exempt from stale automation, so an alert stays visible until a maintainer closes it.

Verification

• The workflow parses cleanly and passes actionlint (v1.7.7) with no findings; the rest of the repo's workflows pass it too, unchanged.
• The two remaining acceptance items — the workflow running green on main and alerts appearing under Security → Code scanning — can only be confirmed after this merges, since code scanning results publish from the default branch. The first scheduled or push run will populate the tab; if the default query suite turns out noisy, the suite can be tuned then, as the issue suggests.

---

Independent builder — not affiliated with the Cardano Foundation, IOG or Intersect.

— Kyle Cox, @Kshot9000 (https://x.com/kshot9000)

Tips: ADA addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v

[IanoNjuguna]

Hey Kyle, welcome to life as a contributor for the DevEx repo. I'm looking at the updates you shipped before merging this request. In the meanwhile, you should pick another issue and work on it.

For instance, we're redesigning the landing page and there is a call for references we can use as inspiration. Your feedback on this is encouraged. The call is on #300

[Kshot3000]

Thanks for the welcome, and for taking a look before merging. The two acceptance items that can only happen after merge (first green run on main, alerts surfacing under Security → Code scanning) are noted in the PR body — happy to follow up if anything looks off there.

I've added feedback on #300 as invited: a measured gap in the current token set (the repeated raw hex values are almost all neutrals with no ramp to point at) plus a short reference list picked for the token-publishing model rather than the visuals.

— Kyle Cox (@Kshot9000, https://x.com/kshot9000) · Independent builder — not affiliated with the Cardano Foundation, IOG or Intersect.
ADA: addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v

[Kshot3000]

Sounds good ill take a look

…

On Fri, Oct 16, 2026, 5:03 AM Ian Njuguna ***@***.***> wrote: *IanoNjuguna* left a comment (IntersectMBO/developer-experience#335) <#335 (comment)> Hey Kyle, welcome to life as a contributor for the DevEx repo. I'm looking at the updates you shipped before merging this request. In the meanwhile, you should pick another issue and work on it. For instance, we're redesigning the landing page and there is a call for references we can use as inspiration. Your feedback on this is encouraged. The call is on #300 <#300> — Reply to this email directly, view it on GitHub <#335?email_source=notifications&email_token=CMAPYQCJQQV35FQJ3GK32PD5UHXABA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMRRGMYDMMZWGUZ2M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-6213063653>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CMAPYQCGPHL4MGKUL6XWMPL5UHXABAVCNFSNUABFKJSXA33TNF2G64TZHM4TANBYGUZDOOJWHNEXG43VMU5TKOBXG42DEOBRGE22C5QC> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[IanoNjuguna]

Ran this on the PR instead of waiting for merge, and pushed three commits to the branch.

What the run proves: run 39112022661, pull_request, 52s, green:

• checkout → init → analyze all pass on a fork PR.
• Analysis 1975259485 uploaded against refs/pull/335/merge: tool CodeQL, category /language:javascript-typescript, 87 rules, 0 results.
• 274 files extracted, including website/** and scripts/fetch-github-data.js.
• The token on a fork PR is Contents: read + SecurityEvents: read. GitHub downgrades the requested security-events: write, and the SARIF upload still succeeds.

So of the two items that "can only be confirmed after merge": alerts landing in code scanning is now demonstrated, results are published for the PR ref and the first-run baseline is clean at 87 rules. What's left unproven is the literal push-event run on main with a write-capable token. Same steps, same code path, but it is the only part of the acceptance criteria that still needs the merge, so leave that box unchecked until it happens.

Three commits on top of the branch

• ci(codeql): constrain the run and trim the token: concurrency group so a newer run cancels the one it supersedes; persist-credentials: false so the token isn't left in .git/config for a job that never pushes; dropped packages: read and actions: read, which the CodeQL starter template marks as required only in private repositories. Resulting token is contents: read + security-events: write.

• chore: drop the stray .claude worktree gitlinks: this one was load-bearing. persist-credentials: false makes actions/checkout run git submodule foreach, which dies with fatal: No url found for submodule path '.claude/worktrees/amazing-mendel' because three paths under .claude/worktrees were committed as submodule gitlinks with no .gitmodules entry. That is what turned the first hardened run red. Removing the three index entries fixes it and clears the error annotation that every run in this repo has been carrying.

• TRIAGE.md now states that CodeQL covers source only and that workflow/configuration files under .github/ stay a manual review item.

Deliberately out of scope here

• SHA-pinning the actions. The whole repo pins tags (actions/checkout@v6, codeql-action@v4); pinning one file would be inconsistent without pinning all eleven refs. That's a separate change, if it happens at all.
• Query-suite choice. Default suite, 0 findings is a clean baseline; comparing against security-extended needs its own run, and it's the issue's own "tune later" item.