[scanner] fix: enable CodeQL SAST for JavaScript/TypeScript#6229
Conversation
Renames the dormant codeql.yml.disabled to codeql.yml, activating CodeQL analysis for JavaScript/TypeScript on every push to main, every PR, and on a weekly schedule (Monday 04:00 UTC). The workflow already uses pinned SHA refs for all actions, sets minimal permissions (contents:read at top level, security-events:write at job level), and runs the 'security-and-quality' query suite which covers injection, XSS, and similar vulnerabilities in Next.js API routes and the MDX sanitizer identified in the issue. Fixes #6221 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: scanner <scanner@kubestellar.io>
kubestellar-prow
Bot
added
the
dco-signoff: yes
✅ Deploy Preview for kubestellar-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
kubestellar-prow
Bot
added
the
size/M
kubestellar-prow
Bot
added
the
needs-ok-to-test
|
Hi @kubestellar-hive[bot]. Thanks for your PR. I'm waiting for a kubestellar member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Signed-off-by: kubestellar-hive[bot] <kubestellar-hive[bot]@users.noreply.github.com>
The docs repository has GitHub's default CodeQL setup enabled in Settings. Advanced CodeQL workflow files cannot coexist with the default setup — GitHub rejects the SARIF upload with: 'CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled.' The default setup already runs CodeQL for JavaScript/TypeScript (confirmed by the 'CodeQL' check showing on PRs). This advanced workflow is redundant and causes CI failures. Removing it; the existing default setup provides the SAST coverage the scanner was trying to add. Closes: the CI failure on PR #6229. Signed-off-by: kubestellar-hive[bot] <197575415+kubestellar-hive[bot]@users.noreply.github.com> Signed-off-by: kubestellar-hive[bot] <kubestellar-hive[bot]@users.noreply.github.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
kubestellar-prow
Bot
added
size/XS
|
Thank you for your contribution! Your PR has been merged. Check out what's new:
Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey |
Summary
Activates the dormant
codeql.yml.disabledworkflow by renaming it tocodeql.yml, enabling CodeQL static analysis for JavaScript/TypeScript.The workflow:
main, every PR targetingmain, and weekly (Monday 04:00 UTC)security-and-qualityquery suite (covers injection, XSS, prototype pollution, etc.)contents:readat top level,security-events:writeat job level (to upload SARIF)This addresses the gap identified in #6221 — Next.js API routes and the MDX sanitizer were not covered by any SAST tool. CodeQL will now analyze
src/app/api/search/route.tsand other server-side TypeScript on every PR.Test plan
Fixes #6221
🤖 Generated with Claude Code