This is an automated email from the ASF dual-hosted git repository.
sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-newtmgr.git
The following commit(s) were added to refs/heads/master by this push:
new 376a1b6 ci: Report more CodeQL findings
376a1b6 is described below
commit 376a1b6b633ec17665cd8c548efddf881f8c9a67
Author: Szymon Janc <[email protected]>
AuthorDate: Tue Oct 20 22:15:46 2026 +0200
ci: Report more CodeQL findings
Run the security-and-quality query suite instead of the default one,
which only has a small set of high precision security queries.
Enable the local threat model so command line arguments, environment
variables, files and stdin are treated as untrusted input. With only
the default remote sources the taint tracking queries have nothing to
start from in a command line tool.
Build manually with go build instead of autobuild, which picked up the
legacy Makefile and modified go.mod with GOPATH style go get calls.
Assisted-by: Claude:claude-opus-5-5
---
.github/workflows/codeql.yml | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 300b58e..d4de7dc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,10 +37,18 @@ jobs:
security-events: write
steps:
- uses: actions/checkout@v7
+ - uses: actions/setup-go@v7
+ with:
+ go-version: 'stable'
- uses: github/codeql-action/init@v4
with:
languages: go
- build-mode: autobuild
+ build-mode: manual
+ queries: security-and-quality
+ config: |
+ threat-models: local
+ - name: Build
+ run: go build ./...
- uses: github/codeql-action/analyze@v4
with:
category: /language:go
