From de0c0399a556314cabf34316a3be409994db0cc2 Mon Sep 17 00:00:00 2001 From: "h.nejati" Date: Mon, 26 Oct 2026 18:32:30 +0330 Subject: [PATCH 1/2] ci: add CodeQL and dependency review --- .github/workflows/codeql.yml | 34 +++++++++++++++++++++++++ .github/workflows/dependency-review.yml | 23 +++++++++++++++++ 2 files changed, 57 insertions(+) create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..8a0c5c83 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,34 @@ +name: CodeQL + +on: + push: + branches: [master] + pull_request: + branches: [master] + paths: + - 'archipy/**' + - 'packages/**' + - '.github/workflows/codeql.yml' + schedule: + - cron: "0 3 * * 1" # Mondays at 3:00 UTC + +permissions: + contents: read + +jobs: + analyze: + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - uses: actions/checkout@v6 + + - uses: github/codeql-action/init@v4 + with: + languages: python + build-mode: none + + - uses: github/codeql-action/analyze@v4 + with: + category: "/language:python" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 00000000..7dcc1531 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,23 @@ +name: Dependency review + +on: + pull_request: + branches: [master] + paths: + - 'pyproject.toml' + - 'uv.lock' + - 'packages/**/pyproject.toml' + - '.github/workflows/dependency-review.yml' + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + + - uses: actions/dependency-review-action@v4 + with: + fail-on-severity: high From 78b1dd9a864b6d7bca2ec69d89de88a449aea152 Mon Sep 17 00:00:00 2001 From: "h.nejati" Date: Mon, 26 Oct 2026 18:35:40 +0330 Subject: [PATCH 2/2] ci: drop the CodeQL workflow, default setup is enabled --- .github/workflows/codeql.yml | 34 ---------------------------------- 1 file changed, 34 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 8a0c5c83..00000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: CodeQL - -on: - push: - branches: [master] - pull_request: - branches: [master] - paths: - - 'archipy/**' - - 'packages/**' - - '.github/workflows/codeql.yml' - schedule: - - cron: "0 3 * * 1" # Mondays at 3:00 UTC - -permissions: - contents: read - -jobs: - analyze: - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - steps: - - uses: actions/checkout@v6 - - - uses: github/codeql-action/init@v4 - with: - languages: python - build-mode: none - - - uses: github/codeql-action/analyze@v4 - with: - category: "/language:python"