This is an automated email from the ASF dual-hosted git repository.
sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-newt.git
The following commit(s) were added to refs/heads/master by this push:
new 9cf4db85 ci: Report more CodeQL findings
9cf4db85 is described below
commit 9cf4db85ffd376ea1d939f4f0f4307d7163694f4
Author: Szymon Janc <[email protected]>
AuthorDate: Tue Oct 20 22:15:46 2026 +0200
ci: Report more CodeQL findings
Run the security-and-quality query suite instead of the default one,
which only has a small set of high precision security queries.
Enable the local threat model so command line arguments, environment
variables, files and stdin are treated as untrusted input. With only
the default remote sources the taint tracking queries have nothing to
start from in a command line tool.
Build manually with go build instead of autobuild, which would pick up
the Makefile meant for deb packaging and build through build.sh.
Assisted-by: Claude:claude-opus-5-5
---
.github/workflows/codeql.yml | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 594ec90e..d5c7ff92 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,10 +37,18 @@ jobs:
security-events: write
steps:
- uses: actions/checkout@v7
+ - uses: actions/setup-go@v7
+ with:
+ go-version: 'stable'
- uses: github/codeql-action/init@v4
with:
languages: go
- build-mode: autobuild
+ build-mode: manual
+ queries: security-and-quality
+ config: |
+ threat-models: local
+ - name: Build
+ run: go build ./...
- uses: github/codeql-action/analyze@v4
with:
category: /language:go
