docs(connections): retitle the Database parity row — MF is ODBC, not JDBC #71
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Deep semantic SAST (taint / data-flow analysis) that complements bandit and the curated semgrep | |
| # rules in security.yml — it finds vulnerable flows those pattern matchers can't, e.g. untrusted | |
| # HL7/config data reaching a sink across function boundaries. | |
| # | |
| # WHY THIS IS GUARDED TO THE MIRROR: CodeQL uploads results to GitHub code scanning, which on a | |
| # PRIVATE repo requires paid GitHub Advanced Security (see security.yml's header note). This repo's | |
| # source of truth is private, but the OSS mirror MEFORORG/MessageFoundry is PUBLIC, where CodeQL + | |
| # code scanning are FREE. So the analyze job is gated on the repo slug: it is SKIPPED (a no-op) on the | |
| # private source repo and runs only once publish.ps1 mirrors this file to MEFORORG/MessageFoundry. | |
| # Nothing to pay, nothing to fail on the private side. | |
| # | |
| # PINNING CAVEAT: this repo SHA-pins every Action for supply-chain integrity. actions/checkout below | |
| # reuses the repo's existing v7.0.0 pin; the github/codeql-action steps are on the v3 tag for now | |
| # because the live commit SHA must be looked up at authoring — SHA-pin them before treating this as a | |
| # hardened gate (OSSF Scorecard / zizmor would flag the unpinned tags). | |
| # | |
| # ALTERNATIVE (no file): on the public mirror you can instead enable CodeQL "default setup" from | |
| # Settings -> Security -> Code scanning (one toggle, auto-pinned, auto-updated). Default setup and this | |
| # advanced workflow are mutually exclusive — if you turn default setup ON, delete this file. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Weekly, so newly-shipped CodeQL queries run against unchanged code (same rationale as the daily | |
| # pip-audit cron: a fresh finding against a quiet codebase shouldn't wait for the next push). | |
| - cron: "0 7 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: CodeQL (${{ matrix.language }}) | |
| # ONLY on the public mirror — code scanning is free there; on the private source repo it would need | |
| # paid GHAS, so this is a skipped no-op there. (GitHub Actions string == is case-insensitive.) | |
| if: github.repository == 'MEFORORG/MessageFoundry' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write # upload the SARIF results to code scanning | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # python = the engine; javascript-typescript = the ide/ VS Code extension (both ship to the | |
| # mirror). Both are interpreted — CodeQL needs no build step. Drop a language to narrow scope. | |
| language: [python, javascript-typescript] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false # CodeQL uploads via the job token, not a persisted git credential | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # security-extended adds higher-recall security queries on top of the default suite. | |
| queries: security-extended | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| category: "/language:${{ matrix.language }}" |