ci: add CodeQL analysis and Docker ecosystem to Dependabot (#791)

mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-22 08:06:42 +00:00

* ci: add CodeQL analysis and Docker ecosystem to Dependabot

Add CodeQL workflow running javascript-typescript analysis weekly and on
every PR/push to main, using the security-extended query suite. All three
codeql-action steps are SHA-pinned.

Add the docker package-ecosystem to dependabot.yml so Dependabot opens
weekly PRs to bump Dockerfile digest pins (FROM node:22-alpine@sha256:...
and the golang builder stage) when upstream images are updated.

* ci(codeql): upgrade codeql-action to v3.35.2

v3.29.0 uses Node.js 20, which is deprecated on GitHub-hosted runners as
of April 2026, causing SARIF upload failures with "Resource not accessible
by integration." v3.35.2 runs on Node.js 24 and resolves the deprecation.

* ci(codeql): add actions:read permission for workflow run API

CodeQL v3.35.2 calls the GitHub Actions REST API to fetch workflow run
context for SARIF correlation, which requires actions:read. Without it,
the analyze step fails with "Resource not accessible by integration"
when calling /repos/{owner}/{repo}/actions/runs/{run_id}.

This commit is contained in:

Anso

2026-04-26 23:30:43 -04:00

committed by

GitHub

parent 3668c71860

commit e49553b18a

2 changed files with 38 additions and 85 deletions

									
										.github/dependabot.yml
									
		+7
		
												View File
												
				@@ -33,6 +33,13 @@ updates:

				      all-npm-frontend:

				        patterns: ["*"]

				  - package-ecosystem: "docker"

				    directory: "/"

				    schedule:

				      interval: "weekly"

				    labels:

				      - "dependencies"

				  - package-ecosystem: "github-actions"

				    directory: "/"

				    schedule: