CodeQL actions/missing-workflow-permissions: lock.yml, pr-any.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
Nothing proposes updates to the workflow actions: several still declare
the Node 20 runtime, which runners already force to Node 24 with a warning
on every run. Dependabot now checks them monthly and groups all action
updates into one pull request.
- continue-on-error is removed; lint, test and build each have to pass,
and fail-fast is off so each reports on its own
- after each step the tree must be unchanged (eslint --fix,
packageInfo.ts written by the build)
- after build, scripts/check-built-manifests.py checks the package.json
npm receives from each build/ directory
- push-main installs with --immutable and checks the manifests too
- the auto-approve and auto-merge bots are removed
This workflow file sets up CodeQL analysis for the repository, defining triggers for pushes and pull requests on the main branch, and scheduling regular scans.
- Update README with Dijital Kurdistan Tech Institute author
- Fix lock.yml to use github.token instead of GH_PAT_BOT
- Rename push-master.yml to push-main.yml for main branch
- Add workflow_dispatch triggers for manual runs
SatoshiQaziMuhammed