Auditor workflow

Updated Oct 17, 2026

  • CV-006 checks where a CodeScene uploader keeps its token. For a repository whose workflows upload to CodeScene, the environment codescene must exist with a custom deployment branch policy admitting the branch main alone, and CS_ACCESS_TOKEN must be a secret of that environment and not a repository secret. Each result carries a status property naming the step still outstanding: environment-missing, policy-not-custom, policy-not-main-only, secret-not-moved or secret-missing. Reading secret names needs a token allowed to list them; a refused read is reported as indeterminate, never as a pass.

  • Scheduled audits run via .github/workflows/auditor.yml every day at 05:00 UTC. Results land in GitHub's Code Scanning dashboard because the workflow uploads the generated Static Analysis Results Interchange Format (SARIF) file using the GitHub github/codeql-action/upload-sarif action.

  • Trigger the workflow manually with Run workflow to inspect a specific revision. Provide snapshot_path (for example, tests/fixtures/auditor/snapshot.json) to replay a recorded API response and set upload_sarif to false when only a local artefact is required.

  • Run the same workflow locally with act:

  CONCORDAT_RUN_ACT_TESTS=1 pytest tests/workflows/test_auditor_workflow.py -k auditor

The test reads tests/fixtures/workflows/auditor-workflow-dispatch.json, downloads workflow artefacts under a temporary directory, and asserts that the SARIF log structure is valid.