From 757a6d8fb753ee5a14022ee17295576d4ba0b4b3 Mon Sep 17 00:00:00 2001 From: mrbobbytables Date: Mon, 12 Oct 2026 13:33:11 +0000 Subject: [PATCH 1/2] docs(security): note CodeQL also analyses Actions workflows Closes #1346 Hive-Run: cncf/endusers#1346 Hive-Plan: issue-1346 docs fix Hive-Spec: security-md#codeql-scope Signed-off-by: mrbobbytables --- SECURITY.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 04c37da5..b5bcdecb 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -25,8 +25,9 @@ maintained by volunteers, so timelines for fixes vary with severity. This policy covers the site source, build scripts, and GitHub Actions workflows in this repository. [Dependabot](.github/dependabot.yml) opens pull requests for routine npm and GitHub Actions version updates, and -[CodeQL](.github/workflows/codeql.yml) scans the JavaScript/TypeScript source on -pushes to main, pull requests, and a weekly schedule. Report all vulnerabilities +[CodeQL](.github/workflows/codeql.yml) scans the JavaScript/TypeScript source and +the GitHub Actions workflows (the `actions` language) on pushes to main, pull +requests that touch either, and a weekly schedule. Report all vulnerabilities in third-party dependencies here, including ones with no fixed version available yet. From 08d23be6ee31a6032fce1da3d387c3ab26007412 Mon Sep 17 00:00:00 2001 From: mrbobbytables Date: Mon, 12 Oct 2026 11:41:09 -0500 Subject: [PATCH 2/2] style: format SECURITY.md with prettier Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables --- SECURITY.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index b5bcdecb..b70d2ba5 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -25,11 +25,11 @@ maintained by volunteers, so timelines for fixes vary with severity. This policy covers the site source, build scripts, and GitHub Actions workflows in this repository. [Dependabot](.github/dependabot.yml) opens pull requests for routine npm and GitHub Actions version updates, and -[CodeQL](.github/workflows/codeql.yml) scans the JavaScript/TypeScript source and -the GitHub Actions workflows (the `actions` language) on pushes to main, pull -requests that touch either, and a weekly schedule. Report all vulnerabilities -in third-party dependencies here, including ones with no fixed version available -yet. +[CodeQL](.github/workflows/codeql.yml) scans the JavaScript/TypeScript source +and the GitHub Actions workflows (the `actions` language) on pushes to main, +pull requests that touch either, and a weekly schedule. Report all +vulnerabilities in third-party dependencies here, including ones with no fixed +version available yet. ## Known unpatched dependency advisories