Refs #260 (do not auto-close).
Defect: WorkflowAudit.check_codeql_language_matrix_mismatch is gated Keyword.get(opts, :has_codeql_supported_language, true) — defaults true, so it is a silent no-op. ScorecardIngestor.check_sast only greps for the string codeql (presence, not efficacy). modshells alert #72: codeql.yml matrix was javascript-typescript on an Ada/Scheme repo → 0 results recorded.
Fix:
- Compute
has_codeql_supported_language from repo linguist/file extensions by default; absence of a scannable language is the trigger, not silence.
- Add a paired effective-SAST rule: finding when codeql.yml language matrix ∌ any language the repo contains AND ∌
actions.
- Canonical remediation:
language: actions (always scannable; runs every commit).
Refs #260 (do not auto-close).
Defect:
WorkflowAudit.check_codeql_language_matrix_mismatchis gatedKeyword.get(opts, :has_codeql_supported_language, true)— defaults true, so it is a silent no-op.ScorecardIngestor.check_sastonly greps for the stringcodeql(presence, not efficacy). modshells alert #72: codeql.yml matrix wasjavascript-typescripton an Ada/Scheme repo → 0 results recorded.Fix:
has_codeql_supported_languagefrom repo linguist/file extensions by default; absence of a scannable language is the trigger, not silence.actions.language: actions(always scannable; runs every commit).