Enable repository secret scanning, push protection, and CodeQL default setup

[TheSilkky]

Enable repository secret scanning, push protection, and CodeQL default setup

Priority

P2

Type

security-hardening

Labels

Suggested GitHub labels:

• backlog
• security
• maintenance
• ci

Branch scope

• Current branch: develop
• Current HEAD: 3555d1fd531ecd4b51b85779618bf4717514aa25
• Target branch: develop
• Original reviewed branch/ref: upgrade-codex-reports-and-repo-full-validation-security-review
• Original reviewed commit SHA: e609ff86028c81bd149839e03d1ffc0eb2ee9e4a
• Merged source pull request: #378
• Target release/version: unreleased
• Scope classification: follow-up-after-merge
• Revalidation status: Revalidated against develop at 3555d1fd531ecd4b51b85779618bf4717514aa25 on 2026-07-12; repeat if develop moves before issue creation.

Summary

Review repository plan availability and safely enable secret scanning, push protection, and CodeQL default setup for open-proofline/server.

Context

The technical review's read-only live settings check found private vulnerability reporting and Dependabot security updates enabled, while secret scanning, push protection, and CodeQL default setup were not enabled or configured.

Issues #21, #22, and #49 cover adjacent Actions permission, pinning, and vulnerability-signal work. None tracks these repository security services.

This is sanitized preventive hardening, not a vulnerability report.

Proposed change

Confirm feature availability and expected maintainer/fork behavior, enable the supported secret-scanning and push-protection controls, configure CodeQL default setup for the repository's Go code, and document any resulting check or triage workflow.

Apply live repository settings only in a separately authorized maintainer action. Do not put tokens, alerts, secrets, private findings, or raw scan output into public issue discussion.

Acceptance criteria

• Repository plan and feature availability are confirmed before configuration changes.
• Secret scanning is enabled if available.
• Push protection is enabled if available, with maintainer handling documented.
• CodeQL default setup is enabled for Go with an appropriate query suite.
• Fork/Dependabot behavior and required permissions are reviewed before making a new check mandatory.
• Any emitted CodeQL check name is observed before an approved ruleset update.
• Security reporting docs continue to route suspected vulnerabilities through SECURITY.md and private vulnerability reporting.
• No secret value, alert payload, private finding, or sensitive scan output is copied into public artifacts.

Tests / validation

• Re-read the repository security-and-analysis settings after any approved change.
• Confirm CodeQL configuration and the first completed analysis run.
• Confirm secret-scanning and push-protection states through sanitized settings output.
• Run scripts/check-markdown-links.py if docs change.
• Run git diff --check for local documentation changes.
• Revalidate required-check behavior before any ruleset change.
• Revalidate against the target branch before public issue creation.

Out of scope

• Publishing suspected vulnerabilities, secret values, alerts, exploit details, or scan traces.
• Enabling unavailable paid features without a maintainer decision.
• Automatically changing required checks before stable check names have emitted.
• Replacing private vulnerability reporting or Dependabot.
• Treating automated scanning as a formal audit, penetration test, or guarantee of security.
• Changing unrelated GitHub Apps, deployment credentials, or repository access.

Notes

Report reference: docs/reports/2026-07-10-proofline-unreleased-technical-review.md, public security-hardening follow-up.

Related completed work: issues #21, #22, and #49.

This local draft does not authorize a GitHub repository-settings mutation.