From 1566abd6813f634a8ddff83fd1e2e3056c0446f1 Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Tue, 28 Jul 2026 19:50:25 +0300 Subject: [PATCH 1/3] ci: require code owner review --- .github/CODEOWNERS | 1 + 1 file changed, 1 insertion(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..78d77bb --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @kriptoburak @furkanerday From d02ad62c0e0195eae49c20abf5a49b55b2e4372a Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Tue, 28 Jul 2026 19:55:39 +0300 Subject: [PATCH 2/3] docs: license code owner policy --- .github/CODEOWNERS | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 78d77bb..b655d2b 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1 +1,4 @@ +# SPDX-FileCopyrightText: 2026 Xquik Contributors +# SPDX-License-Identifier: MIT + * @kriptoburak @furkanerday From 23b67d551fbc51a030770d1e88d1257c6d73a54a Mon Sep 17 00:00:00 2001 From: kriptoburak Date: Tue, 28 Jul 2026 20:37:07 +0300 Subject: [PATCH 3/3] ci: add code scanning workflows --- .github/workflows/codeql.yml | 39 ++++++++++++++++++++++++++++ .github/workflows/scorecard.yml | 46 +++++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+) create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/scorecard.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..bf57f5f --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,39 @@ +# Copyright the Xquik contributors. +# SPDX-License-Identifier: MIT + +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: "19 4 * * 3" + +permissions: + contents: read + +jobs: + analyze: + name: Analyze JavaScript And TypeScript + runs-on: ubuntu-24.04 + timeout-minutes: 20 + permissions: + contents: read + security-events: write + steps: + - name: Check out source + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Initialize CodeQL + uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2 + with: + languages: javascript-typescript + build-mode: none + queries: security-extended + + - name: Analyze + uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..e120c1a --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,46 @@ +# Copyright the Xquik contributors. +# SPDX-License-Identifier: MIT + +name: OpenSSF Scorecard + +on: + push: + branches: [main] + schedule: + - cron: "41 3 * * 6" + +permissions: read-all + +jobs: + analysis: + name: Scorecard Analysis + runs-on: ubuntu-24.04 + timeout-minutes: 20 + permissions: + contents: read + security-events: write + id-token: write + steps: + - name: Check out source + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run analysis + uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + with: + results_file: results.sarif + results_format: sarif + publish_results: true + + - name: Upload artifact + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: scorecard-results + path: results.sarif + retention-days: 5 + + - name: Upload to code scanning + uses: github/codeql-action/upload-sarif@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2 + with: + sarif_file: results.sarif