mirror of
https://github.com/openclaw/clawhub.git
synced 2026-08-14 00:47:57 +00:00
Jesse Merhi
2cf2636ab8
Remove the repo-managed local staged-secret hook and scanner now that GitHub secret scanning push protection is the primary secret-blocking control.
39 lines
764 B
YAML
39 lines
764 B
YAML
name: clawhub-codeql-repository-automation-security
|
|
|
|
disable-default-queries: true
|
|
|
|
queries:
|
|
- uses: security-extended
|
|
|
|
query-filters:
|
|
- include:
|
|
precision:
|
|
- high
|
|
- very-high
|
|
tags contain: security
|
|
security-severity: /([7-9]|10)\.(\d)+/
|
|
|
|
paths:
|
|
- scripts/clawhub-cli-npm-release-check.mjs
|
|
- scripts/github
|
|
- scripts/verify-convex-contract.ts
|
|
- scripts/copy-og-assets.ts
|
|
- scripts/check-peer-deps.ts
|
|
|
|
paths-ignore:
|
|
- "**/node_modules"
|
|
- "**/coverage"
|
|
- "**/dist"
|
|
- "**/dist/**"
|
|
- "**/*.generated.ts"
|
|
- "**/*.bundle.js"
|
|
- "**/*.test.ts"
|
|
- "**/*.test.tsx"
|
|
- "**/*.e2e.test.ts"
|
|
- "**/*.e2e.test.tsx"
|
|
- "**/*test-support*"
|
|
- "**/*test-helper*"
|
|
- "**/*mock*"
|
|
- "**/*fixture*"
|
|
- "**/*bench*"
|