From b2059606cd4acf6b86a18e750d70f1dcac94988a Mon Sep 17 00:00:00 2001
From: Julien Danjou <julien@danjou.info>
Date: Wed, 21 Oct 2026 03:22:59 +0200
Subject: [PATCH] ci: add a security policy, Scorecard and CodeQL

This repository ships a GitHub Action that runs in other people's CI, and
it has had no security policy and no code scanning.

SECURITY.md sends vulnerability reports to Mergify's HackerOne program,
other security questions to security@mergify.com, and links the
disclosure policy, the same as the mergify-cli repository. It also says
how fixes reach users: a new vX.Y.Z release, with `v1` moved to it.

`.github/workflows/scorecard.yaml` runs OpenSSF Scorecard on pushes to
main, weekly and on branch protection changes, publishes the result to
the Scorecard API and uploads the SARIF to code scanning. The job runs
on `ubuntu-latest` rather than `ubuntu-26.04`: the API only accepts
results from a workflow that follows its restrictions, and its list of
runner labels does not include 26.04 yet.

`.github/workflows/codeql.yaml` runs CodeQL with the `actions` language
on pull requests, on main and weekly. That language covers both the
workflows and action.yml, including the composite action's shell step,
which is where an injection would reach users.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Change-Id: Id7bb2a36ac14cd6b9359d2c744fa1baf1a583682
---
 .github/workflows/codeql.yaml    | 36 +++++++++++++++++++++++++++
 .github/workflows/scorecard.yaml | 42 ++++++++++++++++++++++++++++++++
 SECURITY.md                      | 29 ++++++++++++++++++++++
 3 files changed, 107 insertions(+)
 create mode 100644 .github/workflows/codeql.yaml
 create mode 100644 .github/workflows/scorecard.yaml
 create mode 100644 SECURITY.md

diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
new file mode 100644
index 0000000..cd066d3
--- /dev/null
+++ b/.github/workflows/codeql.yaml
@@ -0,0 +1,36 @@
+name: CodeQL
+permissions: read-all
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+      - devs/**
+  schedule:
+    - cron: 41 4 * * 1
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # The repository's code is action.yml and the workflows; the actions
+  # language covers both, including the composite action's shell step.
+  analyze:
+    timeout-minutes: 10
+    runs-on: ubuntu-26.04
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          languages: actions
+
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
new file mode 100644
index 0000000..4827a2b
--- /dev/null
+++ b/.github/workflows/scorecard.yaml
@@ -0,0 +1,42 @@
+name: Scorecard
+permissions: read-all
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: 17 4 * * 1
+  branch_protection_rule:
+
+# Results are published to api.securityscorecards.dev, which only accepts
+# them from a workflow that follows its restrictions:
+# https://github.com/ossf/scorecard-action#workflow-restrictions
+jobs:
+  analysis:
+    # The API rejects runner labels it does not know, and its list stops
+    # short of ubuntu-26.04.
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          sarif_file: results.sarif
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..34448d2
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,29 @@
+# Security Policy
+
+This policy covers the `Mergifyio/setup-cli` GitHub Action published in this
+repository. The CLI it installs and the installer it runs (`install.sh`) live
+in [Mergifyio/mergify-cli](https://github.com/Mergifyio/mergify-cli), which
+has its own policy; reports for either go to the same place.
+
+## Reporting a vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues,
+discussions or pull requests.
+
+Report them privately through Mergify's bug bounty program on HackerOne:
+<https://hackerone.com/mergify>. For other security questions, write to
+<security@mergify.com>.
+
+A useful report says which version of the action you used (the `uses:` line
+of your workflow), how to reproduce the issue and what an attacker gains
+from it.
+
+Mergify's vulnerability disclosure policy is published at
+<https://docs.mergify.com/security/#vulnerability-disclosure>.
+
+## Supported versions
+
+Security fixes ship in a new `vX.Y.Z` release of the action, and the major
+tag (`v1`) moves to it. Workflows that use `Mergifyio/setup-cli@v1` pick the
+fix up on their next run; workflows pinned to a full version or a commit SHA
+need to bump it.