From 405b4c3f0accb9c5097a9dbbbbd556ab60ea5a70 Mon Sep 17 00:00:00 2001 From: forkless Date: Thu, 11 Jun 2026 16:55:31 +0200 Subject: [PATCH] add CodeQL note to governance docs --- docs/GOVERNANCE.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/GOVERNANCE.md b/docs/GOVERNANCE.md index dc4d310..185eaf0 100644 --- a/docs/GOVERNANCE.md +++ b/docs/GOVERNANCE.md @@ -81,6 +81,9 @@ not published. The maintainer tests the draft binaries before publishing. > tagged release. The `.intoto.jsonl` file is included with the > binaries. No configuration needed. +> CodeQL static analysis is enabled on every push and pull request. +> Alerts are reviewed before release. Currently zero open alerts. + Before signing a release tag, the maintainer verifies: - [ ] Impact analysis completed — all call sites for new/changed functions identified and updated