Extend CodeQL to the actions language, settle on security-extended, and document the alert dismissal policy (#341)

.github/workflows/codeql.yml

@@ -36,6 +36,13 @@ jobs:
             # JavaScript/TypeScript is extracted directly from source, so no
             # build step is needed (the Docusaurus site in website/ included).
             build-mode: none
+          - language: actions
+            # The Actions extractor reads the workflow YAML under
+            # .github/workflows/ directly, so no build step is needed either.
+            # These are the highest-privilege files in the repo (deploy.yml
+            # holds pages: write and id-token: write), so they get the same
+            # SAST coverage as the website sources.
+            build-mode: none
 
     steps:
       - name: Checkout repository
@@ -49,6 +56,11 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
+          # Settled by the comparison run recorded on #341: on this tree
+          # security-extended runs 103 javascript-typescript rules and 23
+          # actions rules (default: 87 and 17) and still reports 0 results
+          # for both languages, so the wider suite costs no alert noise.
+          queries: security-extended
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v4

TRIAGE.md

@@ -53,10 +53,24 @@ The [`stale.yml`](.github/workflows/stale.yml) workflow enforces the inactivity
 Two automated scanners run on this repository, and their findings are triaged in the same weekly session as issues and PRs:
 
 - **Dependabot** (`.github/dependabot.yml`) — checks npm dependencies in `website/` and the GitHub Actions used by the workflows, weekly on Mondays. Alerts and update PRs appear under **Security → Dependabot** and as `dependencies`-labelled PRs.
-- **CodeQL** (`.github/workflows/codeql.yml`) — static analysis (SAST) of the JavaScript/TypeScript sources on every push and pull request to `main`, plus a weekly scheduled run on Mondays. Results appear under **Security → Code scanning**. CodeQL reads source only: workflow and configuration files under `.github/` are not covered by this scan and stay a manual review item.
+- **CodeQL** (`.github/workflows/codeql.yml`) — static analysis (SAST) of the JavaScript/TypeScript sources and, via the `actions` language, of the workflow files under `.github/workflows/`, on every push and pull request to `main`, plus a weekly scheduled run on Mondays. Results appear under **Security → Code scanning**.
 
 Items labelled `Security` are never marked stale (see automation above), so a scanning alert stays visible until a maintainer closes it as fixed or dismissed with a reason.
 
+### Dismissing a code scanning alert
+
+Only a maintainer (a triager listed under [Roles](#roles) with write access) may dismiss a code scanning alert. Contributors can propose a dismissal in a comment, but the dismissal itself is a maintainer action.
+
+Acceptable dismissal reasons — use the matching GitHub reason code:
+
+| Reason code | When it applies |
+| --- | --- |
+| `false positive` | The flagged pattern cannot occur as written — e.g. the value CodeQL tracks is a constant, or the sink is unreachable in this code. The dismissal comment must say why. |
+| `won't fix` | The finding is real but the risk is accepted — e.g. a low-severity pattern in a build script that never handles untrusted input. The comment must record the reasoning and who accepted the risk. |
+| `used in tests` | The flagged code exists only in test fixtures or test helpers and never ships or runs against real input. |
+
+Not acceptable: dismissing an alert because fixing it is inconvenient, because the deadline is close, or without a comment explaining the case. If none of the three reason codes honestly fits, the alert stays open and gets fixed. Dismissals are revisited in the monthly stale-item review; a dismissal whose reasoning no longer holds is reopened.
+
 ## Roles
 
 - **Triagers**: Developer Advocates and the repository maintainers listed in [CODEOWNERS](CODEOWNERS).