Repository navigation
ci: add Dependabot version updates and CodeQL code scanning - #72
Merged
Merged
Conversation
Snipdeck had no dependency or code-scanning coverage, unlike the other .NET repos. Both files are modelled on NextIteration.Standards, adapted for an app: no per-TFM floor ignores (there are no floors to protect), and CodeQL runs buildless because Snipdeck.App needs the Windows App SDK to compile, which an ubuntu runner lacks. The two P/Invoke audit queries are excluded because WindowsHotkeyService calls user32 deliberately. Dependabot alerts, security updates and secret scanning with push protection were enabled in the repository settings alongside this. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds dependency and code-scanning coverage to Snipdeck, which had none.
In this PR
.github/dependabot.yml: weekly NuGet and GitHub Actions updates. Minor and patch bumps are grouped into one PR per ecosystem; majors arrive individually for review..github/workflows/codeql.yml: C# CodeQL on push and PR tomain, plus a weekly scheduled scan, using thesecurity-and-qualityqueries.Both files are modelled on NextIteration.Standards and adapted for an app rather than copied:
ignoreentries. Those protect multi-targeted libraries, and Snipdeck has no floors to protect.build-mode: none.Snipdeck.Appneeds the Windows App SDK to compile, which an ubuntu runner lacks, and buildless extraction still reads its source. This is also what makespaths-ignoreforobj/andbin/take effect.cs/unmanaged-codeandcs/call-to-unmanaged-codeare excluded, becauseWindowsHotkeyServicecallsuser32on purpose. Every other query still runs on that file.Repository settings (already applied, not part of the diff)
There's no
CHANGELOG.mdentry, because this changes nothing user-visible.🤖 Generated with Claude Code