[Aymen (aymenfurter)]

Description

The review-request workflow needs a targeted policy exception to continue using pull_request_target. Add GitHub Actions to the CodeQL matrix with the extended security suite so checkout risks are checked. The existing JavaScript and TypeScript scan is unchanged.

A repository administrator must still allow pull_request_target for .github/workflows/request-pull-request-reviews.yml only. This PR does not configure the policy.

Related Issues

N/A

Checklist

• npm run check passes (typecheck + lint + spellcheck + knip + tests)
• Changes are covered by tests (if applicable)
• Documentation updated (if applicable)

Validation:

• TMPDIR=/private/tmp npm run check - passed.
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/codeql.yml - passed.
• CodeQL 2.27.4 extended Actions scan of the review-request workflow - no findings, including the required checkout and TOCTOU queries.

Additional automated tests and documentation changes are not applicable to this workflow configuration change.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.