From 0a3c1b0d015370b072e2eb29fa5a0b1f37566f45 Mon Sep 17 00:00:00 2001 From: Kyle Cox Date: Sun, 18 Oct 2026 11:45:47 +0000 Subject: [PATCH 1/2] feat(ci): extend CodeQL to the actions language and document the alert dismissal policy (#341) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workflow merged in #335 covers the website sources only. The workflow files under .github/workflows/ are the highest-privilege code in this repo (deploy.yml holds pages: write and id-token: write) and nothing analysed them. - Add an actions matrix entry (build-mode: none) alongside javascript-typescript, so workflow YAML gets the same SAST coverage: the actions query pack covers code injection in workflows, unpinned or third-party actions and cleartext credentials, among others. - TRIAGE.md: the Security scanning section now records that workflows are covered, and a new subsection states the code scanning dismissal policy — only a maintainer may dismiss, and only with one of the three GitHub reason codes (false positive / won't fix / used in tests), each with its bar for what the dismissal comment must show. The query-suite comparison (default vs security-extended) numbers are recorded on #341; this change keeps the suite that comparison supports. --- .github/workflows/codeql.yml | 7 +++++++ TRIAGE.md | 16 +++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3db063c..6d6bf11 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -36,6 +36,13 @@ jobs: # JavaScript/TypeScript is extracted directly from source, so no # build step is needed (the Docusaurus site in website/ included). build-mode: none + - language: actions + # The Actions extractor reads the workflow YAML under + # .github/workflows/ directly, so no build step is needed either. + # These are the highest-privilege files in the repo (deploy.yml + # holds pages: write and id-token: write), so they get the same + # SAST coverage as the website sources. + build-mode: none steps: - name: Checkout repository diff --git a/TRIAGE.md b/TRIAGE.md index c4339da..bf4e006 100644 --- a/TRIAGE.md +++ b/TRIAGE.md @@ -53,10 +53,24 @@ The [`stale.yml`](.github/workflows/stale.yml) workflow enforces the inactivity Two automated scanners run on this repository, and their findings are triaged in the same weekly session as issues and PRs: - **Dependabot** (`.github/dependabot.yml`) — checks npm dependencies in `website/` and the GitHub Actions used by the workflows, weekly on Mondays. Alerts and update PRs appear under **Security → Dependabot** and as `dependencies`-labelled PRs. -- **CodeQL** (`.github/workflows/codeql.yml`) — static analysis (SAST) of the JavaScript/TypeScript sources on every push and pull request to `main`, plus a weekly scheduled run on Mondays. Results appear under **Security → Code scanning**. CodeQL reads source only: workflow and configuration files under `.github/` are not covered by this scan and stay a manual review item. +- **CodeQL** (`.github/workflows/codeql.yml`) — static analysis (SAST) of the JavaScript/TypeScript sources and, via the `actions` language, of the workflow files under `.github/workflows/`, on every push and pull request to `main`, plus a weekly scheduled run on Mondays. Results appear under **Security → Code scanning**. Items labelled `Security` are never marked stale (see automation above), so a scanning alert stays visible until a maintainer closes it as fixed or dismissed with a reason. +### Dismissing a code scanning alert + +Only a maintainer (a triager listed under [Roles](#roles) with write access) may dismiss a code scanning alert. Contributors can propose a dismissal in a comment, but the dismissal itself is a maintainer action. + +Acceptable dismissal reasons — use the matching GitHub reason code: + +| Reason code | When it applies | +| --- | --- | +| `false positive` | The flagged pattern cannot occur as written — e.g. the value CodeQL tracks is a constant, or the sink is unreachable in this code. The dismissal comment must say why. | +| `won't fix` | The finding is real but the risk is accepted — e.g. a low-severity pattern in a build script that never handles untrusted input. The comment must record the reasoning and who accepted the risk. | +| `used in tests` | The flagged code exists only in test fixtures or test helpers and never ships or runs against real input. | + +Not acceptable: dismissing an alert because fixing it is inconvenient, because the deadline is close, or without a comment explaining the case. If none of the three reason codes honestly fits, the alert stays open and gets fixed. Dismissals are revisited in the monthly stale-item review; a dismissal whose reasoning no longer holds is reopened. + ## Roles - **Triagers**: Developer Advocates and the repository maintainers listed in [CODEOWNERS](CODEOWNERS). From c1b9149f40544dc8591029d06e114c6883445804 Mon Sep 17 00:00:00 2001 From: Kyle Cox Date: Sun, 18 Oct 2026 11:49:40 +0000 Subject: [PATCH 2/2] feat(ci): settle the CodeQL query suite on security-extended (#341) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Comparison run on a throwaway fork branch, both suites against this tree (numbers also recorded on #341): - default suite: javascript-typescript 87 rules, actions 17 rules — 0 results - security-extended suite: javascript-typescript 103 rules, actions 23 rules — 0 results The wider suite surfaces nothing extra on the current code, so the noise risk does not materialise and the extra 22 rules are free coverage. Making it the default here rather than leaving the suite un-chosen. --- .github/workflows/codeql.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 6d6bf11..3d6cd7a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -56,6 +56,11 @@ jobs: with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} + # Settled by the comparison run recorded on #341: on this tree + # security-extended runs 103 javascript-typescript rules and 23 + # actions rules (default: 87 and 17) and still reports 0 results + # for both languages, so the wider suite costs no alert noise. + queries: security-extended - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v4