security: add CodeQL and Dependabot automation - #2
Conversation
Reviewer's GuideIntroduces weekly Dependabot updates for NuGet and GitHub Actions, adds Windows/.NET 8 CodeQL security-extended scanning for C#, and applies least-privilege permissions to CI and analysis jobs. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/codeql.yml" line_range="6-7" />
<code_context>
pull_request:
branches: [main]
</code_context>
<issue_to_address>
**issue (broader_impact):** CodeQL results from pull requests opened from forks are not uploaded because GitHub withholds `security-events: write` from forked workflows, so the workflow does not provide the advertised PR analysis coverage for external contributions.
**Triggers:** When a pull request originates from a fork.
**Suggested fix:** Add a safe, separately designed privileged reporting workflow or explicitly document that fork pull requests are analyzed without upload; do not switch blindly to `pull_request_target` while executing untrusted checkout code.
```suggestion
# Fork pull requests are analyzed without uploading CodeQL results because
# GitHub withholds security-events: write from forked workflows.
pull_request:
branches: [main]
```
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and if the workflow or Dependabot configuration is wrong, it could create incorrect dependency-update pull requests or persist inaccurate CodeQL findings and security metadata in GitHub. Reverting removes future automation, but already-created pull requests or findings would need to be closed or cleared separately; the impact is bounded and repairable.
Blocking findings: .github/workflows/codeql.yml:7
| pull_request: | ||
| branches: [main] |
There was a problem hiding this comment.
issue (broader_impact): CodeQL results from pull requests opened from forks are not uploaded because GitHub withholds security-events: write from forked workflows, so the workflow does not provide the advertised PR analysis coverage for external contributions.
Triggers: When a pull request originates from a fork.
Suggested fix: Add a safe, separately designed privileged reporting workflow or explicitly document that fork pull requests are analyzed without upload; do not switch blindly to pull_request_target while executing untrusted checkout code.
| pull_request: | |
| branches: [main] | |
| # Fork pull requests are analyzed without uploading CodeQL results because | |
| # GitHub withholds security-events: write from forked workflows. | |
| pull_request: | |
| branches: [main] |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Adds Windows-based CodeQL security-extended analysis for the WPF C# codebase, weekly Dependabot coverage for NuGet and GitHub Actions, and scopes CI permissions to the build job for least privilege.
Summary by Sourcery
Strengthen repository security automation and CI permission scoping.
New Features:
Enhancements:
CI: