Repository navigation
chore(deps): Update openai requirement from <4.0.0,>=1.40.0 to >=3.13.0,<4.0.0 #384
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Static analysis (SAST) for the Python engine. Satisfies the OpenSSF | |
| # Scorecard SAST check and — more to the point — runs real code scanning on | |
| # every push/PR so a regression surfaces in the Security tab rather than in | |
| # production. Default query suite (high-signal security queries) to keep the | |
| # baseline triage-able; promote to `security-extended` once it is triaged. | |
| # | |
| # Scope note: this pass scans `python` only. The JavaScript verifier surface | |
| # (single_file_demo / standalone_verifier / worker) is security-critical and a | |
| # good follow-up to add here behind a `paths-ignore` for the vendored bundle — | |
| # kept out of this first pass to bound new-alert noise. | |
| # | |
| # All third-party Actions are SHA-pinned (R0.3 / scripts/lint_workflow_pins.py), | |
| # reusing the same commit SHAs already vetted in the other workflows. | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| schedule: | |
| - cron: '27 4 * * 1' # Weekly, Mondays 04:27 UTC (off-peak). | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (python) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # upload CodeQL results to code scanning | |
| actions: read | |
| contents: read | |
| steps: | |
| - name: Harden runner (audit-only) | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| languages: python | |
| build-mode: none | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| category: "/language:python" |