You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Pin GitHub Actions to full-length commit SHAs (#47)
* Initial plan
* Pin GitHub Actions to full-length commit SHAs and add workflow instructions
Agent-Logs-Url: https://github.com/advanced-security/codeql-development-template/sessions/2b09ef7b-423b-462a-93f1-8107507d935f
Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>
* Remove unrelated codeql-pack.lock.yml files accidentally included
Agent-Logs-Url: https://github.com/advanced-security/codeql-development-template/sessions/2b09ef7b-423b-462a-93f1-8107507d935f
Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>
* Upgrade codeql CLI to version 2.25.2
Upgrades the codeql CLI version from 2.23.5 to 2.25.2 in an attempt
to resolve unit testing failures for bundled CodeQL queries.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>
Co-authored-by: Nathan Randall <data-douser@github.com>
description: 'Instructions for editing GitHub Actions workflows for this repository.'
4
+
---
5
+
6
+
# Copilot Instructions for `.github/{actions,workflows}/**/*.{yml,yaml}` files
7
+
8
+
## PURPOSE
9
+
10
+
This file contains instructions for working with GitHub Actions YAML files in the `.github/actions/` and `.github/workflows/` directories of the `codeql-development-template` repository.
11
+
12
+
## REQUIREMENTS
13
+
14
+
-**ALWAYS pin ALL external GitHub Actions to full-length commit SHAs, never to tags or branch names — including GitHub-maintained `actions/*` actions.** Add a trailing comment with the original tag for readability (e.g., `uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6`). To resolve a tag to its underlying commit SHA (handling annotated tags correctly), run `git ls-remote https://github.com/OWNER/REPO.git refs/tags/TAG^{}`; for branch-based refs, use `refs/heads/BRANCH`.
15
+
- ALWAYS use the principle of least privilege, and explicitly set `permissions` for workflows.
16
+
- ALWAYS use valid YAML syntax and follow GitHub Actions workflow conventions.
17
+
- ALWAYS follow best practices for GitHub Actions workflows including security, efficiency, and maintainability.
18
+
- ALWAYS use descriptive names for workflows, jobs, and steps that clearly explain their purpose.
19
+
- ALWAYS check formatting with `npm run lint && npm run format:check` from the repo root directory to ensure consistent formatting after making changes.
20
+
- ALWAYS fix linting and formatting errors by running `npm run lint:fix && npm run format` from the repo root directory before committing changes.
21
+
22
+
## PREFERENCES
23
+
24
+
- PREFER explicit permissions declarations using the `permissions` key for security.
25
+
- PREFER descriptive step names that include the workflow context (e.g., "Lint and Format - Checkout repository").
26
+
- PREFER matrix strategies for testing multiple versions when applicable.
27
+
- PREFER adding summary outputs using `$GITHUB_STEP_SUMMARY` for better workflow visibility.
28
+
29
+
## CONSTRAINTS
30
+
31
+
-**NEVER reference an external GitHub Action by tag or branch name (e.g., `@v6`, `@main`). ALWAYS use the full 40-character commit SHA with a `# tag` comment.**
32
+
- NEVER use overly broad permissions.
33
+
- NEVER leave any trailing whitespace on any line.
34
+
- NEVER use deprecated GitHub Actions or workflow syntax.
35
+
- NEVER commit workflow files without running the formatting checks first.
0 commit comments