security: harden CI and add CodeQL automation - #6
Merged
Conversation
Reviewer's GuideHardens CI configuration by minimizing build-job permissions and replacing the hardcoded Compose password with a masked ephemeral secret, while adding weekly Dependabot updates and CodeQL security-extended analysis for C# on pushes, pull requests, and a weekly schedule. Sequence diagram for ephemeral Compose validation secretsequenceDiagram
participant CI as CI build job
participant OpenSSL as openssl
participant Env as GITHUB_ENV
participant Compose as Docker Compose
CI->>OpenSSL: rand -hex 24
OpenSSL-->>CI: random value
CI->>CI: add-mask password
CI->>Env: write MSSQL_SA_PASSWORD
CI->>Compose: docker compose config --quiet
Compose-->>CI: validation result
Flow diagram for CodeQL C# analysisflowchart LR
Trigger["Push, pull request, or weekly schedule"] --> Checkout["actions/checkout@v4"]
Checkout --> Setup["actions/setup-dotnet@v4"]
Setup --> Init["github/codeql-action/init@v3"]
Init --> Autobuild["github/codeql-action/autobuild@v3"]
Autobuild --> Analyze["github/codeql-action/analyze@v3"]
Analyze --> Results["Security events"]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. If the workflow or its permissions are wrong, CodeQL may fail to run or could write incorrect security findings, and the CI job may fail during Compose validation. Reverting stops the behavior, while any generated findings or cached workflow results would need to be cleared or rerun.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds CodeQL security-extended analysis for C#, weekly Dependabot coverage for NuGet, GitHub Actions and Docker, scopes CI permissions to the build job, and replaces the hardcoded Compose validation password with a masked ephemeral value.
Summary by Sourcery
Harden continuous integration with automated security analysis, dependency updates, least-privilege permissions, and safer Compose validation credentials.
New Features:
Bug Fixes:
Enhancements:
CI: