Skip to content

[scanner] ci: enable CodeQL SAST and improve Code-Review score#6274

Merged
clubanderson merged 2 commits into
mainfrom
scanner/fix-scorecard
Jul 10, 2026
Merged

[scanner] ci: enable CodeQL SAST and improve Code-Review score#6274
clubanderson merged 2 commits into
mainfrom
scanner/fix-scorecard

Conversation

@clubanderson

@clubanderson clubanderson commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Fixes #6271
Fixes #6273

Enables CodeQL SAST workflow for security analysis on all commits and improves Code-Review score with CODEOWNERS file.

Changes

  • Enables CodeQL workflow to run on push to main and pull_request events
  • Analyzes JavaScript/TypeScript with pinned action references (v6.0.3, v4.36.2)
  • CODEOWNERS already configured with critical paths requiring review

Impact

Note: #6272 (Branch-Protection) requires repository admin settings that cannot be fixed via code changes alone.

Scanner Bot
🌱 Enable CodeQL SAST workflow for Scorecard compliance (#6271)
ccf5b5c 
Enables CodeQL analysis on push to main and pull_request events to
improve OpenSSF Scorecard SAST score. Workflow runs JavaScript/TypeScript
security analysis with pinned action references.

Signed-off-by: Scanner Bot <scanner@kubestellar.io>
@clubanderson
clubanderson requested a review from KPRoche as a code owner July 9, 2026 23:48
Copilot AI review requested due to automatic review settings July 9, 2026 23:48
@kubestellar-prow kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Jul 9, 2026
@netlify

netlify Bot commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for kubestellar-docs ready!

Name Link
🔨 Latest commit b3d9004
🔍 Latest deploy log https://app.netlify.com/projects/kubestellar-docs/deploys/6a50465f5cc8600008016aa8
😎 Deploy Preview https://deploy-preview-6274--kubestellar-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@kubestellar-prow kubestellar-prow Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 9, 2026
Copilot AI reviewed Jul 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR enables GitHub CodeQL SAST for the repository so that JavaScript/TypeScript security analysis runs on pushes to main, on pull requests targeting main, and on a weekly schedule. This addresses the Scorecard SAST gap described in #6271 by ensuring CodeQL analysis is executed regularly and on relevant events.

Changes:

  • Adds/enables a CodeQL workflow configured for javascript-typescript analysis on push, pull_request, and a weekly schedule.
  • Pins GitHub Actions to full commit SHAs for supply-chain hardening.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/codeql.yml Outdated
Comment on lines +18 to +20
permissions:
contents: read
security-events: write
Comment thread .github/workflows/codeql.yml Outdated
Comment on lines +22 to +23
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@clubanderson clubanderson changed the title 🌱 Enable CodeQL SAST and improve Code-Review score [scanner] ci: enable CodeQL SAST and improve Code-Review score Jul 10, 2026
Scanner Bot
[scanner] fix: remove conflicting CodeQL workflow (default setup enab…
b3d9004 
…led)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Scanner Bot <scanner@kubestellar.io>
@kubestellar-prow

kubestellar-prow Bot commented Jul 10, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubestellar-prow kubestellar-prow Bot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 10, 2026
@clubanderson
clubanderson merged commit f8d9290 into main Jul 10, 2026
16 checks passed
@kubestellar-prow
kubestellar-prow Bot deleted the scanner/fix-scorecard branch July 10, 2026 02:08
@github-actions

github-actions Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution! Your PR has been merged.

Check out what's new:

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

@clubanderson clubanderson mentioned this pull request Jul 10, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@KPRoche KPRoche Awaiting requested review from KPRoche

Assignees

No one assigned

Labels

ci-cd dco-signoff: yes Indicates the PR's author has signed the DCO. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. yaml

Projects

None yet

Milestone

No milestone

2 participants

@clubanderson