Skip to content

Conversation

whartondylan
Copy link

@whartondylan whartondylan commented Jun 19, 2025

Pre-requisites

  • Prior to submitting a new workflow, please apply to join the GitHub Technology Partner Program: partner.github.com/apply.

Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.


Tasks

For all workflows, the workflow:

  • Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
  • Should use sentence case for the names of workflows and steps (for example, "Run tests").
  • Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
  • Should include comments in the workflow for any parts that are not obvious or could use clarification.
  • Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.

For CI workflows, the workflow:

  • Should be preserved under the ci directory.
  • Should include a matching ci/properties/*.properties.json file (for example, ci/properties/docker-publish.properties.json).
  • Should run on push to branches: [ $default-branch ] and pull_request to branches: [ $default-branch ].
  • Packaging workflows should run on release with types: [ created ].
  • Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, docker-publish.yml).

For Code Scanning workflows, the workflow:

  • Should be preserved under the code-scanning directory.
  • Should include a matching code-scanning/properties/*.properties.json file (for example, code-scanning/properties/codeql.properties.json), with properties set as follows:
    • name: Name of the Code Scanning integration.
    • creator: Name of the organization/user producing the Code Scanning integration.
    • description: Short description of the Code Scanning integration.
    • categories: Array of languages supported by the Code Scanning integration.
    • iconName: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in the icons directory.
  • Should run on push to branches: [ $default-branch, $protected-branches ] and pull_request to branches: [ $default-branch ]. We also recommend a schedule trigger of cron: $cron-weekly (for example, codeql.yml).

Some general notes:

  • This workflow must only use actions that are produced by GitHub, in the actions organization, or
  • This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file:
    # This workflow uses actions that are not certified by GitHub.
    # They are provided by a third-party and are governed by
    # separate terms of service, privacy policy, and support
    # documentation.
    
  • Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
  • Automation and CI workflows cannot be dependent on a paid service or product.

marcogario and others added 30 commits February 19, 2024 15:54
* Update dotnet.yml

Updating versions

* Update dotnet-desktop.yml

Bumping versions

* Update ci/dotnet-desktop.yml

Co-authored-by: Alexis Abril <[email protected]>

---------

Co-authored-by: Alexis Abril <[email protected]>
Co-authored-by: Sviatoslav Sydorenko (Святослав Сидоренко) <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
* Update nextjs.yml

* Update nextjs.yml

---------

Co-authored-by: Alexis Abril <[email protected]>
Limit matrix information in the job name to language by default
links to docs
Code Scanning Update codeql.yml with new build-mode
* update action hashes and version comments

ossf/scorecard-action v2.1.2 is old and doesnt work after a Sigstore
change. https://blog.sigstore.dev/tuf-root-update/

Signed-off-by: Spencer Schrock <[email protected]>

* downgrade actions/upload-artifact to node20 version of v3

dependabot will suggest upgrade to v4.3.1 for repos that can upgrade.
note: v3.pre.node20 is how dependabot refers to the pinned hash, so
use that so it can upgrade the comment

Signed-off-by: Spencer Schrock <[email protected]>

* upgrade github/codeql-action/upload-sarif to v3.24.9

Signed-off-by: Spencer Schrock <[email protected]>

---------

Signed-off-by: Spencer Schrock <[email protected]>
Co-authored-by: Alexis Abril <[email protected]>
Simplifying the CODEOWNERS file to allow respective teams the capabilities to manage PRs as responsibilities have been updated recently. In the short term, this will add notifications to folks for each team.
Adding @actions/starter-workflows to each category to minimize notification pollution.
Update all Pages workflows to use `actions/configure-pages@v5`
…tions#2317)

* Update soos-dast-scan.yml

* Update soos-dast-scan.yml

* Update soos.svg

* Update code-scanning/soos-dast-scan.yml

Co-authored-by: Alexis Abril <[email protected]>

---------

Co-authored-by: Alexis Abril <[email protected]>
… not work properly in laravel when uses Pest instead of PHPUnit (actions#2284)

Co-authored-by: Alexis Abril <[email protected]>
whartondylan and others added 16 commits June 7, 2025 12:55
…il/auto-assign-issue-2.2.0

Bump pozil/auto-assign-issue from 1.11.0 to 2.2.0
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for code scanning alert no. 6: Workflow does not contain permissions
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for code scanning alert no. 4: Workflow does not contain permissions
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for code scanning alert no. 5: Workflow does not contain permissions
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for code scanning alert no. 3: Workflow does not contain permissions
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@whartondylan whartondylan requested review from a team as code owners June 19, 2025 22:44
Copy link
Author

@whartondylan whartondylan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

@whartondylan whartondylan changed the base branch from main to Add_new July 3, 2025 00:41
@whartondylan whartondylan requested a review from a team as a code owner July 3, 2025 00:41
Copy link
Author

@whartondylan whartondylan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

@whartondylan whartondylan changed the base branch from Add_new to main July 3, 2025 00:43
@whartondylan whartondylan changed the base branch from main to Add_new July 3, 2025 00:59
Copy link
Author

@whartondylan whartondylan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

@whartondylan whartondylan reopened this Jul 18, 2025
@github-actions github-actions bot added the code-scanning Related to workflows that show on the Code Scanning setup page label Jul 18, 2025
Copy link
Author

@whartondylan whartondylan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
code-scanning Related to workflows that show on the Code Scanning setup page
Projects
None yet
Development

Successfully merging this pull request may close these issues.