fix(snapshot): preserve sealed OpenClaw config #27898

Workflow file for this run

.github/workflows/code-scanning.yaml at 9a15e6e

	# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
	# SPDX-License-Identifier: Apache-2.0

	# Dedicated security reporting workflow for NemoClaw.
	# CodeQL and ShellCheck publish findings to GitHub code scanning while the
	# existing PR and main workflows remain the merge-gating CI path.
	name: Security / Code Scanning

	on:
	pull_request:
	types: [opened, synchronize, reopened]
	push:
	branches: [main]
	schedule:
	- cron: "23 6 * * 1"
	workflow_dispatch:

	permissions:
	contents: read
	pull-requests: read
	security-events: write

	jobs:
	codeql:
	name: CodeQL (${{ matrix.language }})
	runs-on: ubuntu-latest
	timeout-minutes: 15
	strategy:
	fail-fast: false
	matrix:
	language: [javascript-typescript, python]

	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Initialize CodeQL
	uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
	with:
	languages: ${{ matrix.language }}
	queries: security-and-quality

	- name: Perform CodeQL analysis
	uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4

	shellcheck:
	name: ShellCheck SARIF
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	path: source

	- name: Check out the trusted ShellCheck converter
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha \|\| github.workflow_sha }}
	path: trusted-shellcheck-converter
	sparse-checkout: \|
	scripts/shellcheck-json1-to-sarif.mts
	sparse-checkout-cone-mode: false

	- name: Setup Node.js
	uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
	with:
	node-version: 22.19.0

	- name: Install ShellCheck
	run: \|
	set -euo pipefail
	probe="$RUNNER_TEMP/shellcheck-json1-probe.sh"
	printf '#!/bin/sh\ntrue\n' > "$probe"
	if command -v shellcheck >/dev/null 2>&1 &&
	shellcheck --format=json1 "$probe" >/dev/null 2>&1; then
	echo "Using preinstalled ShellCheck"
	shellcheck --version
	else
	apt_options=(
	-o Acquire::Retries=3
	-o Acquire::http::Timeout=15
	-o Acquire::https::Timeout=15
	)
	if ! sudo apt-get "${apt_options[@]}" update; then
	echo "Failed to update apt package indexes for ShellCheck" >&2
	exit 1
	fi
	if ! sudo apt-get "${apt_options[@]}" install -y shellcheck; then
	echo "Failed to install ShellCheck" >&2
	exit 1
	fi
	if ! shellcheck --format=json1 "$probe" >/dev/null 2>&1; then
	echo "Installed ShellCheck does not support --format=json1" >&2
	exit 1
	fi
	echo "Using installed ShellCheck"
	shellcheck --version
	fi

	- name: Collect shell files
	id: shell-files
	working-directory: source
	run: \|
	git ls-files -z -- '*.sh' 'install.sh' 'uninstall.sh' \| sort -zu > "$GITHUB_WORKSPACE/shell-files.txt"
	if [ -s "$GITHUB_WORKSPACE/shell-files.txt" ]; then
	echo "has_files=true" >> "$GITHUB_OUTPUT"
	else
	echo "has_files=false" >> "$GITHUB_OUTPUT"
	fi

	- name: Generate ShellCheck SARIF
	if: steps.shell-files.outputs.has_files == 'true'
	working-directory: source
	run: \|
	# Ubuntu's packaged ShellCheck may not support --format=sarif.
	# Generate json1 and convert it to SARIF for upload.
	mapfile -d '' -t shell_files < "$GITHUB_WORKSPACE/shell-files.txt"
	sc_exit=0
	if shellcheck --format=json1 -- "${shell_files[@]}" > "$GITHUB_WORKSPACE/shellcheck.json"; then
	sc_exit=0
	else
	sc_exit=$?
	fi

	echo "ShellCheck invocation exit status: $sc_exit"
	case "$sc_exit" in
	0) ;;
	1)
	echo "ShellCheck found issues; continuing because json1 output is available for SARIF conversion."
	;;
	*)
	echo "ShellCheck failed to process the input files (exit=$sc_exit); refusing to convert or upload incomplete results."
	exit "$sc_exit"
	;;
	esac

	conversion_exit=0
	if env -i PATH="$PATH" node --experimental-strip-types \
	"$GITHUB_WORKSPACE/trusted-shellcheck-converter/scripts/shellcheck-json1-to-sarif.mts" \
	"$GITHUB_WORKSPACE/shellcheck.json" "$GITHUB_WORKSPACE/shellcheck.sarif"; then
	conversion_exit=0
	else
	conversion_exit=$?
	fi

	echo "SARIF conversion exit status: $conversion_exit"
	if [ "$conversion_exit" -ne 0 ]; then
	echo "ShellCheck SARIF conversion failed; refusing to upload invalid or stale output."
	exit "$conversion_exit"
	fi

	- name: Check SARIF has runs
	id: sarif-runs
	if: steps.shell-files.outputs.has_files == 'true'
	run: \|
	run_count="$(jq '.runs \| length' shellcheck.sarif)"
	if [ "$run_count" -gt 0 ]; then
	echo "has_runs=true" >> "$GITHUB_OUTPUT"
	else
	echo "has_runs=false" >> "$GITHUB_OUTPUT"
	echo "Skipping SARIF upload because shellcheck.sarif has zero runs."
	fi

	- name: Upload ShellCheck SARIF
	if: steps.shell-files.outputs.has_files == 'true' && steps.sarif-runs.outputs.has_runs == 'true'
	uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
	with:
	sarif_file: shellcheck.sarif
	checkout_path: source

Navigation Menu

Uh oh!

fix(snapshot): preserve sealed OpenClaw config #27898

Workflow file

fix(snapshot): preserve sealed OpenClaw config #27898

Uh oh!

Workflow file for this run