From 7b1b2d6f030b90e02c9039f5e041794a8bdc8716 Mon Sep 17 00:00:00 2001
From: rldyourmnd <danil@nddev.it.com>
Date: Mon, 24 Aug 2026 03:06:29 +0500
Subject: [PATCH] feat(security): scan the engine, which has never been scanned
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This repository has no code scanning. Not stale scanning, not partial —
`GET /code-scanning/analyses` returns `no analysis found`, and default setup is
`not-configured`. Go is 97% of the tree: the compiler, the projection engine,
the release builder, the trust and provenance code that every other repository
in the estate depends on to be correct.

It is not alone. Across the six public modules:

    github-device-sync    Go 97%      nothing
    github-actions        Go 95%      nothing
    ci-workflows          Python 98%  actions, python
    cd-workflows          Python 75%  nothing
    macos-ubuntu-bootstrap Python 62% actions only
    agent-runtime         Go 100%     nothing

Four of six have never been scanned, and they are the whole Go control plane.
The republication carried the code across and left the scanning behind; nothing
failed, because nothing was watching.

Advanced setup rather than default setup, so the caller is pinned, reviewable in
a diff, and says which runner it uses. Pinned to `0.1.4` at the commit that tag
actually resolves to — see NDDev-OpenNetwork/ci-workflows#45 for why that is
worth stating: the estate's twelve other call sites all claim a version `0.13.3`
that has never existed, on an untagged commit from before the first release.

Left OUT of `required_contexts` on purpose. A check that has never produced a
green run should not gate merges on the pull request that introduces it; make it
required once it has passed on `main`.

Verified with the repository's own commands: `scripts/validate_shell.sh` PASS
(8 scripts), `go vet ./...` clean, `go build -trimpath ./core/cmd/gds` ok,
`go test ./...` all packages ok. actionlint 1.7.12 clean.

Also confirmed this does not trip #24: `.github` is not in
`developmentBundleSourcePaths`, and `gds context` on the branch reports no
`GDS_CONTEXT_POLICY_SOURCE_DIGEST_MISMATCH`.
---
 .github/workflows/codeql.yml | 46 ++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..4bae820
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,46 @@
+# Code scanning for this repository. Advanced setup: the caller below is the
+# only scanner, and CodeQL default setup is deliberately left `not-configured`
+# because default setup cannot express a pinned reusable and cannot be reviewed
+# in a diff. Attachment is atomic — enabling default setup later means disabling
+# this workflow first, or the whole attachment fails.
+#
+# Verify rather than trust this comment:
+#   GET /repos/{owner}/{repo}/code-scanning/default-setup  -> not-configured
+#   GET /repos/{owner}/{repo}/actions/workflows            -> this file's state
+name: codeql
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    # Weekly, so a new query release is applied to unchanged code. Without this
+    # a repository that stops changing also stops being scanned.
+    - cron: '0 5 * * 2'
+
+permissions: {}
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analyze:
+    name: codeql
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@b50364e2a415267688c1d845cea6866cdb5e53d6 # 0.1.4
+    with:
+      # Public repository: `pull_request` runs untrusted fork code. Name the
+      # hosted runner explicitly — the reusable's default belongs to the pinned
+      # commit, not to this repository, so inheriting it would let a pin bump
+      # move fork pull requests onto private infrastructure with no diff here.
+      runner: ubuntu-latest
+      # Go is 97% of this repository: the engine itself. `actions` covers the
+      # two workflow files, which hold release and attestation authority.
+      languages: '["go","actions"]'
+      # Go is a compiled language; CodeQL needs a build to extract from. The
+      # reusable sets Go up from go.mod when the language is go.
+      autobuild: true