From 06ab30dd714f163788d67565bbf41439e9a3baa1 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 20 May 2026 09:59:39 +0100 Subject: [PATCH] fix(ci): switch CodeQL language matrix to `actions` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hypatia flagged the repo's codeql.yml as nominal-only SAST (alerts #25 and #28): the matrix listed `javascript-typescript`, but the repo has no source files in any CodeQL-scannable language. Every analyze run therefore exited with "no source files" and recorded zero results, giving false confidence. Switch the matrix to `actions` — CodeQL's GitHub Actions analyser scans workflow files, which every repo has. This makes the SAST real work instead of theatre. Closes Hypatia alerts hypatia/scorecard/StaticAnalysis (#28) and hypatia/workflow_audit/codeql_language_matrix_mismatch (#25). Refs standards#91 Phase D (HCG hygiene). Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9e32d15..0395eea 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,7 +30,7 @@ jobs: fail-fast: false matrix: include: - - language: javascript-typescript + - language: actions build-mode: none steps: