Apply security updates for js-yaml and tar dependencies

.github/dependabot.yml

@@ -27,10 +27,11 @@ updates:
           - "patch"
   - package-ecosystem: github-actions
     directories:
-      - "/.github/workflows"
-      - "/.github/actions"
+      - /.github/workflows
+      - /.github/actions
+      - /
     schedule:
-      interval: weekly
+      interval: daily
     cooldown:
       default-days: 7
       exclude:

.github/workflows/codeql.yml

@@ -32,6 +32,12 @@ jobs:
       security-events: read
 
     steps:
+    - name: Harden the runner
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        use-policy-store: true
+        api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set up default CodeQL bundle
       id: setup-default
@@ -119,6 +125,12 @@ jobs:
       security-events: write
 
     steps:
+    - name: Harden the runner
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        use-policy-store: true
+        api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
     - name: Checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Initialize CodeQL

.github/workflows/debug-artifacts-failure-safe.yml

@@ -45,6 +45,12 @@ jobs:
     timeout-minutes: 45
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Dump GitHub event
         run: cat "${GITHUB_EVENT_PATH}"
       - name: Check out repository
@@ -88,6 +94,12 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Download all artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       - name: Check expected artifacts exist

.github/workflows/debug-artifacts-safe.yml

@@ -43,6 +43,12 @@ jobs:
       security-events: read
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Prepare test
@@ -81,6 +87,12 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Download all artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       - name: Check expected artifacts exist

.github/workflows/post-release-mergeback.yml

@@ -36,6 +36,12 @@ jobs:
       pull-requests: write
 
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Dump environment
         run: env
 

.github/workflows/pr-checks.yml

@@ -87,6 +87,12 @@ jobs:
       group: pr-checks-pr-checks-${{ github.ref }}-${{ github.event_name }}
 
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/prepare-release.yml

@@ -43,6 +43,12 @@ jobs:
       backport_target_branches: ${{ steps.branches.outputs.backport_target_branches }}
 
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/python312-windows.yml

@@ -32,6 +32,12 @@ jobs:
     runs-on: windows-latest
 
     steps:
+    - name: Harden the runner
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        use-policy-store: true
+        api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
     - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: 3.12

.github/workflows/query-filters.yml

@@ -29,6 +29,12 @@ jobs:
     permissions:
       contents: read # This permission is needed to allow the GitHub Actions workflow to read the contents of the repository.
     steps:
+    - name: Harden the runner
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        use-policy-store: true
+        api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
     - name: Check out repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/rebuild.yml

@@ -23,6 +23,12 @@ jobs:
       contents: write # needed to push rebuilt commit
       pull-requests: write # needed to comment on the PR
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/rollback-release.yml

@@ -51,6 +51,12 @@ jobs:
       pull-requests: write # needed to create the mergeback PR
 
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/update-bundle.yml

@@ -25,6 +25,12 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull requests
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          use-policy-store: true
+          api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
       - name: Dump environment
         run: env
 

.github/workflows/update-release-branch.yml

@@ -38,6 +38,12 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
+    - name: Harden the runner
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        use-policy-store: true
+        api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0  # Need full history for calculation of diffs
@@ -93,6 +99,12 @@ jobs:
       contents: write # needed to push commits
       pull-requests: write # needed to create pull request
     steps:
+    - name: Harden the runner
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        use-policy-store: true
+        api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
+
     - name: Generate token
       uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
       id: app-token

.pre-commit-config.yaml

@@ -18,3 +18,20 @@ repos:
         language: system
         entry: pr-checks/sync.sh
         pass_filenames: false
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/jumanjihouse/pre-commit-hooks
+    rev: 3.0.0
+    hooks:
+      - id: shellcheck
+  - repo: https://github.com/pre-commit/mirrors-eslint
+    rev: v10.8.0
+    hooks:
+      - id: eslint
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: trailing-whitespace

FORK.md

@@ -0,0 +1,38 @@
+# Fork notes
+
+This is a fork of [`github/codeql-action`](https://github.com/github/codeql-action),
+maintained under [`beer-sakthai`](https://github.com/beer-sakthai) alongside the SakThai
+family repositories. Upstream's own documentation in [`README.md`](README.md) still
+applies in full — this file records only what is specific to the fork.
+
+## Why the fork exists
+
+To stage dependency-advisory remediation against the action's **own** dev-dependency
+tree, where a fix is available inside the existing semver ranges and touches only
+`package-lock.json`. So far:
+
+- `js-yaml` 4.3.0 → 4.3.1 and 3.15.0 → 3.15.1 (GHSA-5p4m-2wfm-xmqj / CVE-2026-59870)
+- `tar` 7.5.20 → 7.5.22 (GHSA-r292-9mhp-454m)
+
+Both are dev-only, so the bundled output under `lib/` is unchanged and needs no rebuild.
+
+## What the fork is *not*
+
+**No workflow in the SakThai repositories references this fork.** They pin **upstream**
+`github/codeql-action` by commit SHA:
+
+- [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) —
+  `codeql.yml`, `bandit.yml`, `ossar.yml`, `scorecard.yml`
+- [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) —
+  `codeql.yml`, `ossar.yml`
+
+Repointing any of them at this fork would defeat the SHA-pinning those repos rely on for
+Scorecard's Pinned-Dependencies check. Consume upstream; use this fork to prepare patches.
+
+## Related repositories
+
+| Repository | What it is |
+|---|---|
+| [`github/codeql-action`](https://github.com/github/codeql-action) | Upstream. The source of truth for everything in `README.md` and `CHANGELOG.md`. |
+| [`beer-sakthai/Sak-Family-Agent`](https://github.com/beer-sakthai/Sak-Family-Agent) | The Sak family agent runtime — `sakthai` package, six personas, memory, MCP, web API. |
+| [`beer-sakthai/openenv-rl-training`](https://github.com/beer-sakthai/openenv-rl-training) | The SFT + GRPO training and evaluation pipeline behind the family's models. |

README.md

@@ -1,5 +1,7 @@
 # CodeQL Action
 
+> **Fork of [`github/codeql-action`](https://github.com/github/codeql-action).** See [`FORK.md`](FORK.md) for what differs and for the related SakThai repositories. Everything below is upstream documentation and applies unchanged.
+
 This action runs GitHub's industry-leading semantic code analysis engine, [CodeQL](https://codeql.github.com/), against a repository's source code to find security vulnerabilities. It then automatically uploads the results to GitHub so they can be displayed on pull requests and in the repository's security tab. CodeQL runs an extensible set of [queries](https://github.com/github/codeql), which have been developed by the community and the [GitHub Security Lab](https://securitylab.github.com/) to find common vulnerabilities in your code.
 
 For a list of recent changes, see the CodeQL Action's [changelog](CHANGELOG.md).