Repository navigation
ci: simplify workflows, enable dev branch, and adopt self-repository syntax - #64
Merged
Merged
Conversation
- Delete scan_on_demand workflow; Coverity (weekly + manual) and CodeQL SARIF uploads already provide scan coverage. - Remove initial 'Clean up previous run' step from ci, coverity, daily_build, and pull_request workflows; GitHub runners start clean.
Replace workspace-relative 'uses: ./...' with GitHub's self-repository 'uses: $/...' form for all local composite actions. This enables fully-pinned policy enforcement and avoids loading actions from runtime filesystem state.
- Add CodeQL Advanced workflow (c-cpp, manual build reusing build-dvledtx) triggered on PR + push to main/dev, weekly, and manual. Consolidates the approach from the standalone CodeQL PR. - Replace gitleaks-action with a pinned Gitleaks CLI install (checksum verified) running git-history and directory scans; wire Gitleaks Scan into the CI and daily build workflows. Folds in the Gitleaks PR.
This was referenced Sep 28, 2026
…odes Resolves zizmor github-env high-severity findings by passing scan exit codes via step outputs and consuming them through an env: block.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to the branching-strategy discussion. Cleans up and hardens the GitHub Actions workflows.
Changes
dev: addeddevto branch triggers for CI, Pull Request, and Scorecard so they run equivalently tomain.scan_on_demand.yml: redundant now that Coverity (weekly + manual) and CI/PR analysis steps cover scanning.uses: ./...touses: $/...for fully-pinned policy enforcement (29 refs across 4 workflows).Notes
github/codeql-action/upload-sarifis just the generic SARIF uploader (categorycoverity), not CodeQL.