Audit: GitHub security settings and CodeQL¶
What we check¶
Repository security settings¶
All active repositories should have these settings enabled in Settings > Code security and analysis:
| Setting | Recommended |
|---|---|
| Dependabot security updates | Enabled |
| Secret scanning | Enabled |
| Secret scanning push protection | Enabled |
Additionally recommended:
| Setting | Recommended |
|---|---|
| Allow auto-merge | Enabled |
Delete branch on merge is required rather than recommended, and is checked by its own audit: see delete-branch-on-merge.md.
GitHub CodeQL¶
All public projects should have a
.github/workflows/codeql-analysis.yml for advanced security
scanning.
Private repos are excluded: CodeQL requires a paid GHAS license for private repos. Without GHAS, the workflow will fail.
The CodeQL workflow must have job-level permissions:
The actions: read permission is required for workflow run
telemetry.
Template¶
CodeQL template: templates/codeql/
See: templates/codeql/README.md
Security settings: UI-only configuration, no template needed.
Projects¶
This table is regenerated daily by the consistency audit
workflow from scripts/audit-check.py results; do not edit
it by hand.
Last regenerated: 2026-08-23T06:45:38.740880+00:00
| Project | Status | Issue |
|---|---|---|
| actions | compliant | - |
| agent-python | non-compliant | agent-python#81 |
| client-python | compliant | - |
| client-python-k3s | compliant | - |
| clingwrap | compliant | - |
| cloudgood | non-compliant | cloudgood#5 |
| development | compliant | - |
| divergulent | non-compliant | divergulent#41 |
| instar | compliant | - |
| kerbside | compliant | - |
| kerbside-patches | non-compliant | kerbside-patches#952 |
| library-utilities | non-compliant | library-utilities#36 |
| occystrap | compliant | - |
| private-ci | N/A | - |
| ryll | compliant | - |
| sfui | compliant | - |
| shakenfist | non-compliant | shakenfist#3056 |
Details for non-compliant projects:
- agent-python (Status): Secret scanning not enabled; Secret scanning push protection not enabled
- cloudgood (Status): Secret scanning not enabled; Secret scanning push protection not enabled
- divergulent (Status): Missing .github/workflows/codeql-analysis.yml; Secret scanning not enabled; Secret scanning push protection not enabled
- kerbside-patches (Status): Missing .github/workflows/codeql-analysis.yml
- library-utilities (Status): Missing .github/workflows/codeql-analysis.yml; Secret scanning not enabled; Secret scanning push protection not enabled
- shakenfist (Status): Secret scanning not enabled; Secret scanning push protection not enabled