mirror of
https://github.com/openclaw/openclaw.git
synced 2026-10-03 17:53:39 +00:00
f78f51359d
* chore(deps): refresh dependencies with seven-day cutoff Advance eligible application, native, release, and development dependencies published by 2026-09-09T06:51:52Z. Audit new registry resolutions and native artifact hashes, preserving existing security pins and compatibility holds. Adapt MCP Apps 2 tool discovery and host context, retain Clack cancellation handling, and align the updater fixture with its runtime assembly owner. Synchronize native artifact checks, operational docs, and tooling pins. Validation includes frozen installation, full build, CLI rebuild, typechecks, lint, 96 npm package locks, dependency audits, focused runtime and native proofs, and independent review. Exact-head hosted CI is required before land. * fix(deps): preserve scroll ownership and synchronize toolchain contracts * fix(cli): preserve generic wizard option values after Clack update * docs(lobster): clarify credentials for embedded remote calls * test(cli): use Clack cancellation sentinel in prompt fixtures * fix(ios): avoid opening audio input during relay cancellation * test: reuse dependency update fixtures within line limits * fix(crabbox): retain the previous trusted pnpm pin * test(gateway): synchronize task access churn with page selection * test(macos): isolate the challenge timeout transport fixture * fix(macos): preserve hidden windows through deminiaturization * fix(macos): exclude hidden dashboards from window selection
130 lines
4.9 KiB
YAML
130 lines
4.9 KiB
YAML
name: CodeQL
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
profile:
|
|
description: CodeQL security profile to run
|
|
required: false
|
|
default: all
|
|
type: choice
|
|
options:
|
|
- all
|
|
- security
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
paths:
|
|
- ".github/actions/**"
|
|
- ".github/codeql/**"
|
|
- ".github/workflows/**"
|
|
- "extensions/acpx/src/**"
|
|
- "extensions/bonjour/src/advertiser.ts"
|
|
- "extensions/browser/src/browser/chrome-mcp.ts"
|
|
- "extensions/browser/src/browser/chrome.executables.ts"
|
|
- "extensions/browser/src/browser/chrome.ts"
|
|
- "extensions/codex/src/app-server/sandbox-exec-server/**"
|
|
- "extensions/codex/src/app-server/transport-stdio.ts"
|
|
- "extensions/codex/src/node-cli-sessions.ts"
|
|
- "extensions/file-transfer/src/**"
|
|
- "extensions/google-meet/src/**"
|
|
- "extensions/imessage/src/**"
|
|
- "extensions/memory-wiki/src/obsidian.ts"
|
|
- "extensions/microsoft-foundry/cli.ts"
|
|
- "extensions/ollama/src/wsl2-crash-loop-check.ts"
|
|
- "extensions/qa-lab/src/**"
|
|
- "extensions/signal/src/daemon.ts"
|
|
- "extensions/tts-local-cli/speech-provider.ts"
|
|
- "extensions/voice-call/src/**"
|
|
- "packages/**"
|
|
- "scripts/**"
|
|
- "src/**"
|
|
push:
|
|
branches:
|
|
- main
|
|
schedule:
|
|
- cron: "0 6 * * *"
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.workflow }}-${{ github.event_name == 'workflow_dispatch' && format('manual-{0}', github.run_id) || github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || format('ref-{0}', github.ref) }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
|
|
|
|
env:
|
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
security-high:
|
|
name: Security High (${{ matrix.category }})
|
|
if: ${{ (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'security') }}
|
|
runs-on: ${{ matrix.runs_on }}
|
|
timeout-minutes: ${{ matrix.timeout_minutes }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: javascript-typescript
|
|
category: core-auth-secrets
|
|
runs_on: ubuntu-24.04
|
|
timeout_minutes: 25
|
|
config_file: ./.github/codeql/codeql-core-auth-secrets-critical-security.yml
|
|
- language: javascript-typescript
|
|
category: channel-runtime-boundary
|
|
runs_on: ubuntu-24.04
|
|
timeout_minutes: 25
|
|
config_file: ./.github/codeql/codeql-channel-runtime-boundary-critical-security.yml
|
|
- language: javascript-typescript
|
|
category: network-ssrf-boundary
|
|
runs_on: ubuntu-24.04
|
|
timeout_minutes: 25
|
|
config_file: ./.github/codeql/codeql-network-ssrf-boundary-critical-security.yml
|
|
- language: javascript-typescript
|
|
category: mcp-process-tool-boundary
|
|
runs_on: ubuntu-24.04
|
|
timeout_minutes: 25
|
|
config_file: ./.github/codeql/codeql-mcp-process-tool-boundary-critical-security.yml
|
|
- language: javascript-typescript
|
|
category: process-exec-boundary
|
|
runs_on: ubuntu-24.04
|
|
timeout_minutes: 25
|
|
config_file: ./.github/codeql/codeql-process-exec-boundary-critical-security.yml
|
|
- language: javascript-typescript
|
|
category: plugin-trust-boundary
|
|
runs_on: ubuntu-24.04
|
|
timeout_minutes: 25
|
|
config_file: ./.github/codeql/codeql-plugin-trust-boundary-critical-security.yml
|
|
- language: actions
|
|
category: actions
|
|
runs_on: ubuntu-24.04
|
|
timeout_minutes: 10
|
|
config_file: ./.github/codeql/codeql-actions-critical-security.yml
|
|
steps:
|
|
- name: Checkout
|
|
if: ${{ matrix.category != 'actions' }}
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
submodules: false
|
|
|
|
- name: Checkout Actions security sources
|
|
if: ${{ matrix.category == 'actions' }}
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
submodules: false
|
|
sparse-checkout: |
|
|
.github/actions
|
|
.github/workflows
|
|
.github/codeql
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
config-file: ${{ matrix.config_file }}
|
|
|
|
- name: Analyze
|
|
uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
|
|
with:
|
|
category: "/codeql-security-high/${{ matrix.category }}"
|