From 164f33d8b7e6ec8f4ab1a89300b9881ade1fe266 Mon Sep 17 00:00:00 2001
From: rldyourmnd <danil@nddev.it.com>
Date: Mon, 24 Aug 2026 03:11:27 +0500
Subject: [PATCH] feat(security): enable code scanning, which has never run
 here
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`GET /code-scanning/analyses` returns `no analysis found` for this repository
and default setup is `not-configured`. Go is 100%.

Four of the six public modules are in this state — github-device-sync,
github-actions, cd-workflows and agent-runtime — and they are the whole Go
control plane. The republication carried the code to the new organisation and
left the scanning behind; nothing failed, because nothing was watching.

Advanced setup rather than default setup, so the caller is pinned, reviewable in
a diff, and names its runner explicitly: the reusable's `runner` default belongs
to the pinned commit, not to this repository, so inheriting it would let a pin
bump move fork pull requests onto private infrastructure with no diff here.

Pinned to `0.1.4` at the commit that tag actually resolves to. The estate's
other twelve call sites claim a version `0.13.3` that has never existed, on an
untagged 2026-08-15 commit — NDDev-OpenNetwork/ci-workflows#45.

Left out of `required_contexts` deliberately: a check with no green run yet
should not gate the pull request that introduces it. Promote it once it has
passed on `main`.

Verified with this repository's own commands: `go vet ./...` clean,
`go test -race ./...` every package ok, the declared build ok, actionlint 1.7.12
clean.
---
 .github/workflows/codeql.yml | 45 ++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..4ab7318
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,45 @@
+# Code scanning for this repository. Advanced setup: the caller below is the
+# only scanner, and CodeQL default setup is deliberately left `not-configured`
+# because default setup cannot express a pinned reusable and cannot be reviewed
+# in a diff. Attachment is atomic — enabling default setup later means disabling
+# this workflow first, or the whole attachment fails.
+#
+# Verify rather than trust this comment:
+#   GET /repos/{owner}/{repo}/code-scanning/default-setup  -> not-configured
+#   GET /repos/{owner}/{repo}/actions/workflows            -> this file's state
+name: codeql
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    # Weekly, so a new query release is applied to unchanged code. Without this
+    # a repository that stops changing also stops being scanned.
+    - cron: '0 5 * * 2'
+
+permissions: {}
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analyze:
+    name: codeql
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@b50364e2a415267688c1d845cea6866cdb5e53d6 # 0.1.4
+    with:
+      # Public repository: `pull_request` runs untrusted fork code. Name the
+      # hosted runner explicitly — the reusable's default belongs to the pinned
+      # commit, not to this repository, so inheriting it would let a pin bump
+      # move fork pull requests onto private infrastructure with no diff here.
+      runner: ubuntu-latest
+      # Go is 100% of this repository.
+      languages: '["go","actions"]'
+      # Go is a compiled language; CodeQL needs a build to extract from. The
+      # reusable sets Go up from go.mod when the language is go.
+      autobuild: true