harald/zeroclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

fix(ci): sync devsecops with main and repair auto-response workflow (#538)

Browse source 
* fix(workflows): standardize runner configuration for security jobs

* ci(actionlint): add Blacksmith runner label to config

Add blacksmith-2vcpu-ubuntu-2404 to actionlint self-hosted-runner labels config
to suppress "unknown label" warnings during workflow linting.

This label is used across all workflows after the Blacksmith migration.

* fix(actionlint): adjust indentation for self-hosted runner labels

* feat(security): enhance security workflow with CodeQL analysis steps

* fix(security): update CodeQL action to version 4 for improved analysis

* fix(security): remove duplicate permissions in security workflow

* fix(security): revert CodeQL action to v3 for stability

The v4 version was causing workflow file validation failures.
Reverting to proven v3 version that is working on main branch.

* fix(security): remove duplicate permissions causing workflow validation failure

The permissions block had duplicate security-events and actions keys,
which caused YAML validation errors and prevented workflow execution.

Fixes: workflow file validation failures on main branch

* fix(security): remove pull_request trigger to reduce costs

* fix(security): restore PR trigger but skip codeql on PRs

* fix(security): resolve YAML syntax error in security workflow

* refactor(security): split CodeQL into dedicated scheduled workflow

* fix(security): update workflow name to Rust Package Security Audit

* fix(codeql): remove push trigger, keep schedule and on-demand only

* feat(codeql): add CodeQL configuration file to ignore specific paths

* Potential fix for code scanning alert no. 39: Hard-coded cryptographic value

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* fix(ci): resolve auto-response workflow merge markers

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
This commit is contained in:
Will Sarg 2026-02-17 08:34:09 -05:00 • committed by GitHub
parent a35d1e37c8
commit 7ebc98d8d0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 0 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
.github/workflows/auto-response.yml vendored
View file

@ -36,11 +36,7 @@ jobs:
{ label: "trusted contributor", minMergedPRs: 5 }, { label: "trusted contributor", minMergedPRs: 5 },
]; ];
const contributorTierLabels = contributorTierRules.map((rule) => rule.label); const contributorTierLabels = contributorTierRules.map((rule) => rule.label);
<<<<<<< chore/labeler-spacing-trusted-tier
const contributorTierColor = "39FF14";
=======
const contributorTierColor = "2ED9FF"; // Keep in sync with .github/workflows/labeler.yml const contributorTierColor = "2ED9FF"; // Keep in sync with .github/workflows/labeler.yml
>>>>>>> main
const managedContributorLabels = new Set(contributorTierLabels); const managedContributorLabels = new Set(contributorTierLabels);
const action = context.payload.action; const action = context.payload.action;
const changedLabel = context.payload.label?.name; const changedLabel = context.payload.label?.name;