feat(security): enable code scanning, which has never run here - #4
Merged
Conversation
`GET /code-scanning/analyses` returns `no analysis found` for this repository and default setup is `not-configured`. Go is 100%. Four of the six public modules are in this state — github-device-sync, github-actions, cd-workflows and agent-runtime — and they are the whole Go control plane. The republication carried the code to the new organisation and left the scanning behind; nothing failed, because nothing was watching. Advanced setup rather than default setup, so the caller is pinned, reviewable in a diff, and names its runner explicitly: the reusable's `runner` default belongs to the pinned commit, not to this repository, so inheriting it would let a pin bump move fork pull requests onto private infrastructure with no diff here. Pinned to `0.1.4` at the commit that tag actually resolves to. The estate's other twelve call sites claim a version `0.13.3` that has never existed, on an untagged 2026-08-15 commit — NDDev-OpenNetwork/ci-workflows#45. Left out of `required_contexts` deliberately: a check with no green run yet should not gate the pull request that introduces it. Promote it once it has passed on `main`. Verified with this repository's own commands: `go vet ./...` clean, `go test -race ./...` every package ok, the declared build ok, actionlint 1.7.12 clean.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GET /code-scanning/analysesreturnsno analysis foundfor this repository and default setup isnot-configured. Go is 100% of this repository.It is not one repository
Four of six have never been scanned, and they are the entire Go control plane. The republication carried the code to the new organisation and left the scanning behind. Nothing failed, because nothing was watching — the same shape as NDDev-OpenNetwork/github-device-sync#22, #23 and macos-ubuntu-bootstrap#7.
Secret scanning and push protection were
disabledon all six as well; both are free for public repositories and are now on.The change
Advanced setup, not default setup: the caller is pinned, reviewable in a diff, and names its runner. The reusable's
runnerdefault belongs to the pinned commit rather than to this repository, so inheriting it would let a pin bump move fork pull requests onto private infrastructure with no diff here to review.Pinned to
0.1.4at the commit that tag actually resolves to. Worth stating: the estate's other twelve call sites pin an untagged 2026-08-15 commit while claiming version0.13.3, which has never existed — NDDev-OpenNetwork/ci-workflows#45.Deliberately left out of
required_contexts. A check with no green run yet should not gate the pull request introducing it. Promote it once it has passed onmain.Verification
This repository's own commands, from
.gds/repository.yaml:go vet ./...→ cleango test -race ./...→ every package okgo build ./cmd/agent-runtime→ okExpect first-run findings. That is the point.