build(deps): bump github/codeql-action/init from 3.37.6 to 4.37.6

.github/dependabot.yml

@@ -0,0 +1,42 @@
+version: 2
+updates:
+  # Root package: the CLI, the Action, and the webhook runner.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      dev-dependencies:
+        dependency-type: development
+    labels:
+      - dependencies
+
+  - package-ecosystem: npm
+    directory: /extension
+    schedule:
+      interval: weekly
+    groups:
+      dev-dependencies:
+        dependency-type: development
+    labels:
+      - dependencies
+
+  - package-ecosystem: npm
+    directory: /site
+    schedule:
+      interval: weekly
+    groups:
+      dev-dependencies:
+        dependency-type: development
+    labels:
+      - dependencies
+
+  # Keeps the SHA-pinned `uses:` refs in .github/workflows current — the same
+  # supply-chain hygiene Scorecard's Pinned-Dependencies check rewards, kept
+  # from going stale.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies

.github/drift.yml

@@ -0,0 +1,18 @@
+# Drift's own configuration. See examples/drift.yml for every option and its
+# default, and docs/configuration.md for the full reference.
+
+# Drift ships in `approve` mode by default; dogfooding it here means seeing
+# what it actually proposes rather than what it silently does.
+mode: approve
+
+# Code scanning is on by default, so this line changes nothing — it's here to
+# make the choice explicit for a repository that means to demonstrate it.
+codeScanning:
+  enabled: true
+  includeInformational: true
+
+# Exercises drift-outdated-selftest.yml, which otherwise has nothing to do:
+# `outdated.enabled` is Drift's own opt-in gate, independent of the workflow's
+# schedule trigger existing at all.
+outdated:
+  enabled: true

.github/workflows/ci.yml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   test:
+    name: test
     runs-on: ubuntu-latest
 
     strategy:
@@ -20,9 +21,9 @@ jobs:
         node: [22]
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -32,14 +33,14 @@ jobs:
       # bundle against this binary, because a bundle that works on 22 is not
       # evidence it works on the runtime GitHub will actually use.
       - name: Install Node 24 for the Action runtime check
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 24
       - name: Record the Node 24 binary
         run: echo "DRIFT_NODE24=$(which node)" >> "$GITHUB_ENV"
 
       # Restore the job's own Node version; the step above left 24 on PATH.
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -136,9 +137,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: npm
@@ -160,11 +161,11 @@ jobs:
     if: github.event_name == 'pull_request'
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: npm

.github/workflows/codeql.yml

@@ -0,0 +1,48 @@
+name: CodeQL
+
+# Static analysis of Drift's own source, separate from Drift's own
+# dependency-change findings (`ci.yml`'s dogfood job) and from Scorecard's
+# supply-chain checks (`scorecard.yml`). This is what OpenSSF Scorecard's
+# SAST check looks for: a static analysis tool wired into CI, not just run
+# ad hoc.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Catches new query packs landing upstream, independent of any push here.
+    - cron: '23 4 * * 2'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # The extension is a separate TypeScript project (its own
+        # tsconfig/node_modules) but CodeQL's javascript-typescript analyzer
+        # covers both from the one root query pass.
+        language: ['javascript-typescript']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3.37.6
+        with:
+          category: '/language:${{ matrix.language }}'

.github/workflows/drift-selftest.yml

@@ -4,47 +4,67 @@
 # this repository is private. Referencing a private action from a *different*
 # repository does not resolve; that needs this repo to be public.
 #
-# Trigger it by hand from the Actions tab, or let it fire when Drift's own
-# dependencies change.
+# Three ways this runs: on a push that bumps Drift's own dependencies (the
+# ordinary diff-triggered path), on a weekly schedule (the outdated-dependency
+# scan — see `scan-mode` in src/runners/action.ts, which always takes that
+# path on a `schedule` event regardless of the input below), or by hand from
+# the Actions tab with either mode.
 
 name: Drift (self-check)
 
 on:
   workflow_dispatch:
     inputs:
       dry-run:
-        description: 'Analyse only — create no branches, issues, or agent tasks'
+        description: 'Analyse only — create no branches, issues, or agent tasks (diff mode only)'
         type: boolean
         default: true
       mode:
-        description: 'approve = file an issue and wait · auto = dispatch Copilot'
+        description: 'approve = file an issue and wait · auto = dispatch Copilot (diff mode only)'
         type: choice
         options: [approve, auto]
         default: approve
+      scan-mode:
+        description: 'diff = analyse the push · outdated = scan every installed dependency'
+        type: choice
+        options: [diff, outdated]
+        default: outdated
+      alert-granularity:
+        description: 'How code scanning alerts are grouped. Leave blank to use codeScanning.granularity from drift.yml.'
+        type: choice
+        options: ['', package, breakingChange, affectedSite]
+        default: ''
 
   push:
     branches: [main]
     paths:
       - 'package.json'
       - 'package-lock.json'
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-  checks: write
+  schedule:
+    - cron: '0 9 * * 1'
+
+permissions: {}
 
 jobs:
   selftest:
     runs-on: ubuntu-latest
+    # Drift needs to open branches/PRs, file approval issues, and (in `auto`
+    # mode) report check results — scoped to this one job, not the workflow.
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      checks: write
+      security-events: write # upload code scanning alerts
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           # Drift diffs the manifest against the previous commit.
           fetch-depth: 2
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: npm
@@ -64,6 +84,8 @@ jobs:
           copilot-token: ${{ secrets.DRIFT_COPILOT_TOKEN }}
           dry-run: ${{ inputs.dry-run || 'true' }}
           mode: ${{ inputs.mode || 'approve' }}
+          scan-mode: ${{ inputs.scan-mode || 'outdated' }}
+          alert-granularity: ${{ inputs.alert-granularity }}
           log-level: debug
 
       - name: Result

.github/workflows/pages.yml

@@ -18,8 +18,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 # One deploy at a time, and never cancel one in flight: a half-published site is
 # worse than a slightly stale one.
@@ -34,9 +32,9 @@ jobs:
       run:
         working-directory: site
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: npm
@@ -52,7 +50,7 @@ jobs:
       # repository, including when a custom domain removes it entirely.
       - name: Configure Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
         # `enablement: true` was tried here and cannot work: creating a Pages
         # site needs a permission the workflow's GITHUB_TOKEN does not have
         # ("Resource not accessible by integration"), and asking for it turned
@@ -75,16 +73,22 @@ jobs:
       - name: Disable Jekyll
         run: touch out/.nojekyll
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: site/out
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    # Publishing the built artifact needs pages: write, and OIDC-based
+    # deployment needs id-token: write; scoped to this one job, which is the
+    # only one that touches Pages, rather than the whole workflow.
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/release.yml

@@ -23,28 +23,34 @@ on:
     tags:
       - 'v*.*.*'
 
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    # `gh release create` and moving the floating v0 tag both need contents:
+    # write; scoped to this one job rather than the whole workflow. id-token:
+    # write is for `npm publish --provenance`, which needs to mint an OIDC
+    # token to get the package's Sigstore-signed provenance attestation.
+    permissions:
+      contents: write
+      id-token: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           fetch-depth: 0
 
       # The Action declares `using: node24`. `verify:action-bundle` runs the
       # shipped bundle against this binary, because publishing an Action that
       # only works on 22 fails in the user's repository, not here.
       - name: Install Node 24 for the Action runtime check
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 24
       - name: Record the Node 24 binary
         run: echo "DRIFT_NODE24=$(which node)" >> "$GITHUB_ENV"
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 22
           cache: npm
@@ -110,7 +116,7 @@ jobs:
       # ---- Publish phase: each step here is a public, irreversible action. ----
 
       - name: Publish CLI to npm
-        run: npm publish --access public
+        run: npm publish --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
@@ -135,4 +141,4 @@ jobs:
           if [ "$MAJOR" = "v0" ]; then
             git tag -f v0 "${{ github.ref_name }}"
             git push -f origin v0
-          fi
+          fi