Repository: minvws/nl-kat-coordination
Pull request #4078: Add CodeQL Scan
Author: login: ghost
Labels: name: security
Created: 2025-02-07T14:11:50Z | Merged: 2025-03-05T16:47:04Z

### Changes

Add a security check by enabling CodeQL, this provides more insight into the security quality of the code.

### Issue link
Closes https://github.com/minvws/nl-kat-coordination/issues/4077

### Demo
![image](https://github.com/user-attachments/assets/afcb0068-0ee8-4088-8e94-1aab98e5bcec)

### QA notes

Make a Pull and it will be shown in the tasks overview.

### Code Checklist

<!--- Mandatory: --->

- [X] All the commits in this PR are properly PGP-signed and verified.
- [X] This PR only contains functionality relevant to the issue.
- [X] I have written unit tests for the changes or fixes I made.
- [X] I have checked the documentation and made changes where necessary.
- [X] I have performed a self-review of my code and refactored it to the best of my abilities.

<!--- If applicable: --->

- [x] Tickets have been created for newly discovered issues.
- [x] For any non-trivial functionality, I have added integration and/or end-to-end tests.
- [x] I have informed others of any required `.env` changes files if required and changed the `.env-dist` accordingly.
- [X] I have included comments in the code to elaborate on what is not self-evident from the code itself, including references to issues and discussions online, or implicit behavior of an interface.

---

## Checklist for code reviewers:

Copy-paste the checklist from [the docs/source/templates folder](https://github.com/minvws/nl-kat-coordination/blob/main/docs/source/templates/pull_request_template_review_code.md) into your comment.

---

## Checklist for QA:

Copy-paste the checklist from [the docs/source/templates folder](https://github.com/minvws/nl-kat-coordination/blob/main/docs/source/templates/pull_request_template_review_qa.md) into your comment.



Diff:
diff --git a/.github/workflows/boefjes_container_image.yml b/.github/workflows/boefjes_container_image.yml
index cdefc57b7c4..6afa4e256ca 100644
--- a/.github/workflows/boefjes_container_image.yml
+++ b/.github/workflows/boefjes_container_image.yml
@@ -19,6 +19,9 @@ on:
 
 jobs:
   create_container_image:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
@@ -26,7 +29,7 @@ jobs:
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
         with:
           images: |
             ghcr.io/${{ github.repository_owner }}/nl-kat-boefjes
@@ -36,11 +39,11 @@ jobs:
             type=ref,event=pr
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
         id: buildx
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -54,7 +57,7 @@ jobs:
           cp _version.py boefjes/boefjes/katalogus/version.py
 
       - name: Build container image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           # We don't use git context because that doesn't process .dockerignore
           # https://github.com/docker/cli/issues/2827
diff --git a/.github/workflows/boefjes_tests.yml b/.github/workflows/boefjes_tests.yml
index 62f09f7d954..a07653ac7b6 100644
--- a/.github/workflows/boefjes_tests.yml
+++ b/.github/workflows/boefjes_tests.yml
@@ -19,6 +19,8 @@ on:
 
 jobs:
   Tests:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/build-debian-docker-image.yml b/.github/workflows/build-debian-docker-image.yml
index 7c70336dca7..42c94354955 100644
--- a/.github/workflows/build-debian-docker-image.yml
+++ b/.github/workflows/build-debian-docker-image.yml
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -51,7 +51,7 @@ jobs:
             type=sha
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           context: ./packaging/${{ matrix.dist }}
           push: true
diff --git a/.github/workflows/build_docs_on_pr.yml b/.github/workflows/build_docs_on_pr.yml
index 2684dbd4119..3804d70c8b0 100644
--- a/.github/workflows/build_docs_on_pr.yml
+++ b/.github/workflows/build_docs_on_pr.yml
@@ -18,6 +18,8 @@ on:
 
 jobs:
   build-artifact:
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
diff --git a/.github/workflows/bytes_container_image.yml b/.github/workflows/bytes_container_image.yml
index 68e5aca4cf4..ad2a745249b 100644
--- a/.github/workflows/bytes_container_image.yml
+++ b/.github/workflows/bytes_container_image.yml
@@ -17,6 +17,9 @@ on:
 
 jobs:
   create_container_image:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
@@ -24,7 +27,7 @@ jobs:
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
         with:
           images: |
             ghcr.io/${{ github.repository_owner }}/nl-kat-bytes
@@ -34,11 +37,11 @@ jobs:
             type=ref,event=pr
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
         id: buildx
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -51,7 +54,7 @@ jobs:
           cp _version.py bytes/bytes/version.py
 
       - name: Build container image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           # We don't use git context because that doesn't process .dockerignore
           # https://github.com/docker/cli/issues/2827
diff --git a/.github/workflows/bytes_tests.yml b/.github/workflows/bytes_tests.yml
index fb30746e6e5..7ed4545c60d 100644
--- a/.github/workflows/bytes_tests.yml
+++ b/.github/workflows/bytes_tests.yml
@@ -17,6 +17,8 @@ on:
 
 jobs:
   test:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000000..661d2b6a7c5
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,47 @@
+name: "CodeQL OpenKAT"
+
+on:
+  push:
+    branches:
+      - "main"
+      - "release-*"
+  pull_request:
+  schedule:
+    # Weekly on Sunday.
+    - cron: "30 1 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ["ubuntu-latest"]
+    permissions:
+      # required for all workflows
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+          - language: python
+            build-mode: none
+          - language: actions
+            build-mode: none
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended # Use security extended, when too many false positives we can switch back to default
+
+      # Use the CodeQL tools for analyzing.
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        with:
+          category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/containerized_boefjes.yml b/.github/workflows/containerized_boefjes.yml
index 277d2612de8..cf47a7bd94b 100644
--- a/.github/workflows/containerized_boefjes.yml
+++ b/.github/workflows/containerized_boefjes.yml
@@ -21,6 +21,9 @@ on:
 
 jobs:
   build_containerized_boefjes:
+    permissions:
+      contents: read
+      packages: write
     strategy:
       matrix:
         include:
@@ -35,7 +38,7 @@ jobs:
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
         with:
           images: |
             ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
@@ -45,18 +48,18 @@ jobs:
             type=ref,event=pr
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
         id: buildx
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build container image for ${{ matrix.image }}
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           # We don't use git context because that doesn't process .dockerignore
           # https://github.com/docker/cli/issues/2827
diff --git a/.github/workflows/debian_package.yml b/.github/workflows/debian_package.yml
index c651286350e..56bbe436ce4 100644
--- a/.github/workflows/debian_package.yml
+++ b/.github/workflows/debian_package.yml
@@ -11,11 +11,12 @@ on:
 
 jobs:
   changes:
+    permissions: {}
     runs-on: ubuntu-24.04
     outputs:
       packages: ${{ steps.filter.outputs.changes }}
     steps:
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         if: github.event_name != 'push'
         id: filter
         with:
@@ -42,6 +43,8 @@ jobs:
               - '.github/workflows/debian_package.yml'
 
   build:
+    permissions:
+      contents: read
     needs: changes
     if: ${{ github.event_name == 'push' || (needs.changes.outputs.packages != '[]' && needs.changes.outputs.packages != '') }}
     strategy:
@@ -72,7 +75,7 @@ jobs:
           cp _version.py rocky/rocky/version.py
 
       - name: Run debian package build
-        uses: addnab/docker-run-action@v3
+        uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 # v3
         with:
           run: packaging/scripts/build-debian-package.sh
           registry: ghcr.io
diff --git a/.github/workflows/masscan_container_image.yml b/.github/workflows/masscan_container_image.yml
index 9801ac65555..7bf0de2afdb 100644
--- a/.github/workflows/masscan_container_image.yml
+++ b/.github/workflows/masscan_container_image.yml
@@ -31,11 +31,11 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
         id: buildx
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -55,7 +55,7 @@ jobs:
             type=sha
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           context: ./boefjes/images/masscan
           push: true
diff --git a/.github/workflows/mula_container_image.yml b/.github/workflows/mula_container_image.yml
index bddadcf0d49..c23abc55894 100644
--- a/.github/workflows/mula_container_image.yml
+++ b/.github/workflows/mula_container_image.yml
@@ -17,6 +17,9 @@ on:
 
 jobs:
   create_container_image:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
@@ -24,7 +27,7 @@ jobs:
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
         with:
           images: |
             ghcr.io/${{ github.repository_owner }}/nl-kat-mula
@@ -34,11 +37,11 @@ jobs:
             type=ref,event=pr
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
         id: buildx
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -51,7 +54,7 @@ jobs:
           cp _version.py mula/scheduler/version.py
 
       - name: Build container image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           # We don't use git context because that doesn't process .dockerignore
           # https://github.com/docker/cli/issues/2827
diff --git a/.github/workflows/mula_tests.yml b/.github/workflows/mula_tests.yml
index 5dcffb1827d..540e55927b7 100644
--- a/.github/workflows/mula_tests.yml
+++ b/.github/workflows/mula_tests.yml
@@ -17,6 +17,8 @@ on:
 
 jobs:
   test:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/octopoes_container_image.yml b/.github/workflows/octopoes_container_image.yml
index 1047c255a94..86d19792662 100644
--- a/.github/workflows/octopoes_container_image.yml
+++ b/.github/workflows/octopoes_container_image.yml
@@ -17,6 +17,9 @@ on:
 
 jobs:
   create_container_image:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
@@ -24,7 +27,7 @@ jobs:
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
         with:
           images: |
             ghcr.io/${{ github.repository_owner }}/nl-kat-octopoes
@@ -34,11 +37,11 @@ jobs:
             type=ref,event=pr
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
         id: buildx
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -51,7 +54,7 @@ jobs:
           cp _version.py octopoes/octopoes/version.py
 
       - name: Build container image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           # We don't use git context because that doesn't process .dockerignore
           # https://github.com/docker/cli/issues/2827
diff --git a/.github/workflows/octopoes_rtest.yml b/.github/workflows/octopoes_rtest.yml
index ca539dd2ae4..7f35b858b32 100644
--- a/.github/workflows/octopoes_rtest.yml
+++ b/.github/workflows/octopoes_rtest.yml
@@ -17,6 +17,8 @@ on:
 
 jobs:
   rtest:
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04
 
     steps:
@@ -32,7 +34,7 @@ jobs:
         working-directory: ./octopoes
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
         id: buildx
 
       - name: Run robot tests
diff --git a/.github/workflows/octopoes_tests.yml b/.github/workflows/octopoes_tests.yml
index 40e4807d750..da46a3e1341 100644
--- a/.github/workflows/octopoes_tests.yml
+++ b/.github/workflows/octopoes_tests.yml
@@ -17,6 +17,8 @@ on:
 
 jobs:
   test:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/pre_commit_checks.yml b/.github/workflows/pre_commit_checks.yml
index 37be8e7da19..9ae2971f3a7 100644
--- a/.github/workflows/pre_commit_checks.yml
+++ b/.github/workflows/pre_commit_checks.yml
@@ -12,6 +12,8 @@ on:
 
 jobs:
   pre-commit:
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/rocky_container_image.yml b/.github/workflows/rocky_container_image.yml
index 73f43f40f81..6939530a7fe 100644
--- a/.github/workflows/rocky_container_image.yml
+++ b/.github/workflows/rocky_container_image.yml
@@ -19,6 +19,9 @@ on:
 
 jobs:
   create_container_image:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
@@ -26,7 +29,7 @@ jobs:
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
         with:
           images: |
             ghcr.io/${{ github.repository_owner }}/nl-kat-rocky
@@ -36,11 +39,11 @@ jobs:
             type=ref,event=pr
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
         id: buildx
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -53,7 +56,7 @@ jobs:
           cp _version.py rocky/rocky/version.py
 
       - name: Build container image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
         with:
           # We don't use git context because that doesn't process .dockerignore
           # https://github.com/docker/cli/issues/2827
diff --git a/.github/workflows/rocky_makelang.yml b/.github/workflows/rocky_makelang.yml
index 87e7b4ec508..e2c84df7da0 100644
--- a/.github/workflows/rocky_makelang.yml
+++ b/.github/workflows/rocky_makelang.yml
@@ -17,6 +17,8 @@ on:
 
 jobs:
   makelang:
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/rocky_tests.yml b/.github/workflows/rocky_tests.yml
index b3e245ad28a..7b8af52feab 100644
--- a/.github/workflows/rocky_tests.yml
+++ b/.github/workflows/rocky_tests.yml
@@ -19,6 +19,8 @@ on:
 
 jobs:
   test:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/sonar-cloud.yml b/.github/workflows/sonar-cloud.yml
index faf3f904185..1bae89544fc 100644
--- a/.github/workflows/sonar-cloud.yml
+++ b/.github/workflows/sonar-cloud.yml
@@ -10,17 +10,29 @@ on:
 
 jobs:
   octopoes-tests:
+    permissions:
+      contents: read
     uses: minvws/nl-kat-coordination/.github/workflows/octopoes-tests.yml@main
   bytes-tests:
+    permissions:
+      contents: read
     uses: minvws/nl-kat-coordination/.github/workflows/bytes-tests.yml@main
   mula-tests:
+    permissions:
+      contents: read
     uses: minvws/nl-kat-coordination/.github/workflows/mula-tests.yml@main
   rocky-tests:
+    permissions:
+      contents: read
     uses: minvws/nl-kat-coordination/.github/workflows/rocky-tests.yml@main
   boefjes-tests:
+    permissions:
+      contents: read
     uses: minvws/nl-kat-coordination/.github/workflows/boefjes-tests.yml@main
 
   fix-coverage-reports:
+    permissions:
+      contents: read
     runs-on: ubuntu-24.04
 
     needs:
@@ -58,7 +70,7 @@ jobs:
           path: ${{ matrix.module['name'] }}-coverage-unit
 
       - name: Fix coverage report sources
-        uses: Mudlet/xmlstarlet-action@master
+        uses: Mudlet/xmlstarlet-action@9866e85e774e0fb50bc49de15274d005b5a69f0e # master
         with:
           args: edit --inplace --update "coverage/sources" --value "/github/workspace/${{ matrix.module['name'] }}/" "${{ matrix.module['name'] }}-coverage-unit/coverage.xml"
 
@@ -72,6 +84,10 @@ jobs:
           path: "${{ matrix.module['name'] }}-coverage-unit/coverage.xml"
 
   sonar-cloud:
+    permissions:
+      contents: read
+      pull-requests: write
+      security-events: write
     runs-on: ubuntu-24.04
 
     needs:
@@ -89,6 +105,6 @@ jobs:
           pattern: "*-coverage-unit-fixed"
 
       - name: SonarCloud
-        uses: SonarSource/sonarcloud-github-action@v4.0.0
+        uses: SonarSource/sonarcloud-github-action@ffc3010689be73b8e5ae0c57ce35968afd7909e8 # v5.0.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/.github/workflows/test_debian_packages_on_ubuntu.yml b/.github/workflows/test_debian_packages_on_ubuntu.yml
index 2fcc3bdf89c..7b66fa4e930 100644
--- a/.github/workflows/test_debian_packages_on_ubuntu.yml
+++ b/.github/workflows/test_debian_packages_on_ubuntu.yml
@@ -15,6 +15,8 @@ on:
 
 jobs:
   build-packages:
+    permissions:
+      contents: read
     strategy:
       matrix:
         dist: [ubuntu]
@@ -34,7 +36,7 @@ jobs:
           fi
 
       - name: Run debian package build
-        uses: addnab/docker-run-action@v3
+        uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 # v3
         with:
           run: packaging/scripts/build-debian-package.sh
           registry: ghcr.io
@@ -56,6 +58,8 @@ jobs:
           path: ${{ matrix.package }}/build/kat-${{ matrix.package }}_${{ env.RELEASE_VERSION }}_amd64.deb
 
   test-deb-install:
+    permissions:
+      contents: read
     needs: build-packages
     runs-on: ${{ matrix.os }}
 
diff --git a/docs/source/guidelines/index.rst b/docs/source/guidelines/index.rst
index 26fe5a45d16..e9f2fdd0205 100644
--- a/docs/source/guidelines/index.rst
+++ b/docs/source/guidelines/index.rst
@@ -12,3 +12,4 @@ Contains documentation for developers and contributors.
    ideas
    contributions
    feature_flow
+   security
diff --git a/docs/source/guidelines/security.rst b/docs/source/guidelines/security.rst
new file mode 100644
index 00000000000..f146855a69f
--- /dev/null
+++ b/docs/source/guidelines/security.rst
@@ -0,0 +1,46 @@
+Security
+########
+
+The OpenKAT project is committed to providing a secure environment.
+As a security product ourselves, we take security seriously and strive to be transparent about our security posture.
+
+Security in the pipeline
+=========================
+
+The OpenKAT project uses a variety of tools to ensure the security of the codebase. These include:
+
+SCA
+---
+
+To scan for vulnerabilities in our code base and keep dependencies up-to-date, we use Dependabot, a tool for automated dependency updates built into Github.
+This tool scans the code base for outdated components and vulnerabilities, and creates a pull request to update the dependencies.
+This way we can ensure that the code base is up to date and secure.
+
+SAST
+----
+
+To scan for Security Hotspots in our code base we use the built-in tool from Github, CodeQL and SonarQube Cloud.
+
+**CodeQL**
+
+We have enabled the ``security-extended`` option which may cause some more false positives but also gives a better insight into possible security risks.
+
+The following languages are enabled within our CodeQL scan:
+
+- Python
+- JavaScript / TypeScript
+- GitHub Actions
+
+**SonarQube Cloud**
+
+SonarQube Cloud is used to scan for the code quality, it also looks for Security Hotspots, which are lines of code that may contain vulnerabilities.
+
+Secret scanning
+---------------
+
+To prevent secrets from being exposed in the code base we use the built-in tool from Github, Secret scanning. There is currently no check on the pre-commit for secrets.
+
+DAST
+----
+
+We currently do not have a DAST tool in place, but we are looking into the possibilities to implement this in the future.


Reviews:
user: login: ammar92
body: Nice work 👍 Thanks for extending the documentation about this topic. I only have a few tiny remarks and suggestions, let me know what you think.

Also for a next time, let's keep the scope smaller. The other workflow suggestions seem to be not relevant for CodeQL. From a DevSecOps view I can see why you'd pin the actions like this, but imo it seems quite inconvenient to apply it like this. We use common GitHub Actions in our workflow and Dependabot keeps an eye for vulnerabilities.

Perhaps we could pin on specific release tags, this is easier to read and update for us as maintainers and also compatible with Dependabot? What do you think @underdarknl @dekkers 

I do like the permissions suggestions, this enhances security and prevents mistakes
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-02-25T08:43:12Z
user: login: ammar92
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-04T08:48:51Z
user: login: dekkers
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-04T11:11:58Z
user: login: dekkers
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-04T14:00:34Z
state: COMMENTED
author_association: NONE
submitted_at: 2025-03-05T09:36:47Z
user: login: dekkers
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-05T16:40:01Z
user: login: dekkers
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-05T16:40:57Z

Review comments:
diff_hunk: @@ -0,0 +1,41 @@
+Security
+########
+
+The OpenKAT project is committed to providing a secure environment.
+As a security product ourselves, we take security seriously and strive to be transparent about our security posture.
+
+Security in the pipeline
+=========================
+
+The OpenKAT project uses a variety of tools to ensure the security of the coWdebase. These include:
path: docs/source/guidelines/security.rst
user: login: ammar92
body: ```suggestion
The OpenKAT project uses a variety of tools to ensure the security of the codebase. These include:
```
created_at: 2025-02-25T07:55:57Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,41 @@
+Security
+########
+
+The OpenKAT project is committed to providing a secure environment.
+As a security product ourselves, we take security seriously and strive to be transparent about our security posture.
+
+Security in the pipeline
+=========================
+
+The OpenKAT project uses a variety of tools to ensure the security of the coWdebase. These include:
+
+SCA
+---
+
+To scan for vulnerabilities in our code base we use the built-in tool from Github, Dependabot.
+This tool scans the code base for outdated components and vulnerabilities, and creates a pull request to update the dependencies.
+This way we can ensure that the code base is up to date and secure.
+
+SAST
+----
+
+To scan for code smells in our code base we use the built-in tool from Github, CodeQL.
+We have enabled the ``security-extended`` option which may cause some more false positives but also gives a better insight into possible security risks.
+
+The following languages are enabled within our CodeQL scan:
+
+- Python
+- JavaScript / TypeScript
+- Github Actions
path: docs/source/guidelines/security.rst
user: login: ammar92
body: ```suggestion
- GitHub Actions
```
created_at: 2025-02-25T07:56:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,41 @@
+Security
+########
+
+The OpenKAT project is committed to providing a secure environment.
+As a security product ourselves, we take security seriously and strive to be transparent about our security posture.
+
+Security in the pipeline
+=========================
+
+The OpenKAT project uses a variety of tools to ensure the security of the coWdebase. These include:
+
+SCA
+---
+
+To scan for vulnerabilities in our code base we use the built-in tool from Github, Dependabot.
path: docs/source/guidelines/security.rst
user: login: ammar92
body: ```suggestion
To scan for vulnerabilities in our code base and keep dependencies up to date, we use Dependabot, a tool for automated dependency updates built into GitHub.
```
created_at: 2025-02-25T08:05:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,41 @@
+Security
+########
+
+The OpenKAT project is committed to providing a secure environment.
+As a security product ourselves, we take security seriously and strive to be transparent about our security posture.
+
+Security in the pipeline
+=========================
+
+The OpenKAT project uses a variety of tools to ensure the security of the coWdebase. These include:
+
+SCA
+---
+
+To scan for vulnerabilities in our code base we use the built-in tool from Github, Dependabot.
+This tool scans the code base for outdated components and vulnerabilities, and creates a pull request to update the dependencies.
+This way we can ensure that the code base is up to date and secure.
+
+SAST
+----
+
+To scan for code smells in our code base we use the built-in tool from Github, CodeQL.
path: docs/source/guidelines/security.rst
user: login: ammar92
body: I think *code smell* is not the correct term for this. Code smells are traces in the code that indicate a deeper problem that should be addressed or refactored. They are not necessarily errors or bugs but rather violations of design principles and best practices (aka bad code) which can lead to maintainability issues.

CodeQL focuses on discovering *vulnerabilities* in the codebase, whereas linters are more commonly used to detect *code smells*.

(You *could* use CodeQL to detect code smells by querying AST trees to find specific patterns, but this requires writing intricate queries and is not the primary focus of CodeQL.)
created_at: 2025-02-25T08:27:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -89,6 +105,6 @@ jobs:
           pattern: "*-coverage-unit-fixed"
 
       - name: SonarCloud
-        uses: SonarSource/sonarcloud-github-action@v4.0.0
+        uses: SonarSource/sonarcloud-github-action@02ef91109b2d589e757aefcfb2854c2783fd7b19 # v4.0.0
path: .github/workflows/sonar-cloud.yml
user: login: ammar92
body: v4 is currently being deprecated

```suggestion
        uses: SonarSource/sonarcloud-github-action@ffc3010689be73b8e5ae0c57ce35968afd7909e8 # v5.0.0
```
created_at: 2025-03-04T08:48:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,46 @@
+name: "CodeQL OpenKAT"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
path: .github/workflows/codeql.yml
user: login: dekkers
body: I think this should also run on release branches and for all PRs, also PRs that have release branches or feature branches as target.

```suggestion
  push:
    branches:
      - "main"
      - "release-*"
  pull_request:
```
created_at: 2025-03-04T11:11:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,46 @@
+name: "CodeQL OpenKAT"
+
+on:
+  push:
+    branches: [main, release-*, feature/*]
+  pull_request:
+    branches: ["main"]
path: .github/workflows/codeql.yml
user: login: dekkers
body: This means for every PR the action will run two times, one time because of the push to the feature/ branch and one time because it is a PR. This is what is configured in every other action and works correctly:

```suggestion
  push:
    branches:
      - "main"
      - "release-*"
  pull_request:
```
created_at: 2025-03-04T14:00:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2,9 +2,10 @@ name: "CodeQL OpenKAT"
 
 on:
   push:
-    branches: [main, release-*, feature/*]
+    branches:
+      - "main"
+      - "release-*"
   pull_request:
path: .github/workflows/codeql.yml
body: @ammar92, @dekkers vindt dit persoonlijk geen verbetering over mijn suggestie. Wat is de meerwaarde om buiten de main op elke pull te scannen? Ook lijkt me een push naar feature juist weer een prima plek om een scan te doen.
created_at: 2025-03-05T09:36:47Z
author_association: NONE
diff_hunk: @@ -2,9 +2,10 @@ name: "CodeQL OpenKAT"
 
 on:
   push:
-    branches: [main, release-*, feature/*]
+    branches:
+      - "main"
+      - "release-*"
   pull_request:
path: .github/workflows/codeql.yml
user: login: dekkers
body: - Je wilt ook een PR naar een release branch scannen, want als er iets niet goed is wil je dat ook daar zien. Is bij een release branch misschien nog wel belangrijker dan bij main. Ook doen we sporadisch weleens een PR naar een feature branch om iets afzonderlijk te reviewen/testen en dan is het ook fijn om feedback te krijgen.
- Zoals ik al zei levert de actie draaien bij een push naar een feature branch een dubbele actie op als er ook al een PR is op basis van die branch, daarom draaien de acties alleen op PRs.
- Elke andere github action in onze repo werkt ook op deze manier en het lijkt me goed om dit consistent te houden.
created_at: 2025-03-05T16:40:01Z
author_association: CONTRIBUTOR

PR comments:
user: login: CLAassistant
created_at: 2025-02-07T14:11:56Z
body: [![CLA assistant check](https://cla-assistant.io/pull/badge/signed)](https://cla-assistant.io/minvws/nl-kat-coordination?pullRequest=4078) <br/>All committers have signed the CLA.
author_association: NONE
user: login: github-advanced-security[bot]
created_at: 2025-02-07T14:13:22Z
body: This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on [this overview](/minvws/nl-kat-coordination/security/code-scanning?query=pr%3A4078+is%3Aopen). Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning). 
author_association: CONTRIBUTOR
user: login: ghost
created_at: 2025-02-26T09:25:55Z
body: > Nice work 👍 Thanks for extending the documentation about this topic. I only have a few tiny remarks and suggestions, let me know what you think.
> 
> Also for a next time, let's keep the scope smaller. The other workflow suggestions seem to be not relevant for CodeQL. From a DevSecOps view I can see why you'd pin the actions like this, but imo it seems quite inconvenient to apply it like this. We use common GitHub Actions in our workflow and Dependabot keeps an eye for vulnerabilities.
> 
> Perhaps we could pin on specific release tags, this is easier to read and update for us as maintainers and also compatible with Dependabot? What do you think @underdarknl @dekkers
> 
> I do like the permissions suggestions, this enhances security and prevents mistakes

@ammar92 thanks for the review. The addition of the hashes is because these are finding from CodeQL. In this article it's nicely explained why you would want this: https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash.

Also Dependabot supports this syntax: https://github.com/dependabot/dependabot-core/issues/4691 so updating should not be an issue. But let's do an open discussion because I do understand your concerns.
author_association: NONE
user: login: underdarknl
created_at: 2025-02-27T09:20:16Z
body: > > Nice work 👍 Thanks for extending the documentation about this topic. I only have a few tiny remarks and suggestions, let me know what you think.
> > Also for a next time, let's keep the scope smaller. The other workflow suggestions seem to be not relevant for CodeQL. From a DevSecOps view I can see why you'd pin the actions like this, but imo it seems quite inconvenient to apply it like this. We use common GitHub Actions in our workflow and Dependabot keeps an eye for vulnerabilities.
> > Perhaps we could pin on specific release tags, this is easier to read and update for us as maintainers and also compatible with Dependabot? What do you think @underdarknl @dekkers
> > I do like the permissions suggestions, this enhances security and prevents mistakes
> 
> @ammar92 thanks for the review. The addition of the hashes is because these are finding from CodeQL. In this article it's nicely explained why you would want this: https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash.
> 
> Also Dependabot supports this syntax: [dependabot/dependabot-core#4691](https://github.com/dependabot/dependabot-core/issues/4691) so updating should not be an issue. But let's do an open discussion because I do understand your concerns.

I agree that the hashes could have been done in a separate PR for clarity, however adding them now is fine too.
In itself, adding them might seem overly cautious and adds more work when keeping them 'up to date', however they also provided security and peace of mind that we are dealing (and will be dealing) with the same docker images in our workflows, especially when we use workflows to create our release artifacts.
The argument for trusting them because they are popular doesn't really work for me, as xz was also popular, and continued 'friendly control' over these repos isn't a given. combined with the mutability of tags / versions on docker registries this means we need to use the hash to be sure our well isn't poisoned. 
author_association: COLLABORATOR
user: login: ammar92
created_at: 2025-02-28T08:45:53Z
body: > I agree that the hashes could have been done in a separate PR for clarity, however adding them now is fine too. In itself, adding them might seem overly cautious and adds more work when keeping them 'up to date', however they also provided security and peace of mind that we are dealing (and will be dealing) with the same docker images in our workflows, especially when we use workflows to create our release artifacts. The argument for trusting them because they are popular doesn't really work for me, as xz was also popular, and continued 'friendly control' over these repos isn't a given. combined with the mutability of tags / versions on docker registries this means we need to use the hash to be sure our well isn't poisoned.

This works for me. @BramVWS, could you also apply version pinning to the CodeQL workflow? After that this PR should be ready to merge
author_association: CONTRIBUTOR
user: login: ammar92
created_at: 2025-03-04T08:49:45Z
body: Should be ready for merge now.

Closes #4143 
author_association: CONTRIBUTOR
user: login: sonarqubecloud[bot]
created_at: 2025-03-05T16:46:51Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=minvws_nl-kat-coordination&pullRequest=4078) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=minvws_nl-kat-coordination&pullRequest=4078&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=minvws_nl-kat-coordination&pullRequest=4078&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=minvws_nl-kat-coordination&pullRequest=4078&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=minvws_nl-kat-coordination&pullRequest=4078&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=minvws_nl-kat-coordination&pullRequest=4078&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=minvws_nl-kat-coordination&pullRequest=4078)


author_association: NONE