Security

Please note: this wiki is not secured.

Spammers do periodically attack GitHub wikis and at least a couple of attacks have been made to this specific wiki.

Security Polling

Check Spelling performs Security Polling to verify that the running version isn't known insecure.

Policy

The formal security/policy is in the repository.

Scanning

CodeQL

CodeQL is not used by this repository because it doesn't support Shell/Perl.

CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]

There is a single legacy JavaScript file which replaced Docker and has been replaced by Composite actions as part of the runtime bootstrapping process. Scanning that file is absolutely pointless. The file (and the Dockerfile) will eventually be deleted.

ShellCheck

actions/shellcheck will probably be added eventually.

It's expected that making it happy will require a non-trivial amount of effort.

---

FAQ | Showcase | Event descriptions | Configuration information | Known Issues | Possible features | Deprecations | Release notes | Helpful scripts