Resolve CodeQL findings and restore scan coverage

Author: Codex

.github/workflows/codeql.yml

@@ -26,7 +26,7 @@ jobs:
       - name: 🔍 Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
-          languages: javascript-typescript
+          languages: javascript-typescript, actions
           # Config excludes public/ (154 minified React bundle files) and docs/
           # which would otherwise generate hundreds of false-positive warnings.
           # Uses security-extended only — security-and-quality adds stylistic

audit/current/README.md

@@ -1,7 +1,7 @@
 # Current file audit
 
 Schema: 1
-Worktree fingerprint: 69d98b41205ad15b421b84610e16f9036bff62be09bb1083820e710a9538766e
+Worktree fingerprint: 78276793714b1ccbcad3c278eb0b0003efc5391c32af5bef39d959d34d7ff1f6
 Audited files: 437
 Git-tracked non-audit files: 437
 Untracked non-audit files: 0
@@ -31,7 +31,7 @@ Active/reachable files: 257
 - injection.inner_html: 95
 - network.fetch: 126
 - network.http_client: 12
-- network.supabase_client: 63
+- network.supabase_client: 64
 - network.websocket: 24
 - secrets.identifiers: 55
 - sql.rls: 371

audit/current/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "repository": {
-    "worktreeFingerprint": "69d98b41205ad15b421b84610e16f9036bff62be09bb1083820e710a9538766e"
+    "worktreeFingerprint": "78276793714b1ccbcad3c278eb0b0003efc5391c32af5bef39d959d34d7ff1f6"
   },
   "scope": {
     "source": "Git index paths with current worktree content",
@@ -15,7 +15,7 @@
     "auditedFileCount": 437
   },
   "summary": {
-    "totalBytes": 71977711,
+    "totalBytes": 71978261,
     "activeFileCount": 257,
     "classifications": {
       "authored:configuration": 26,
@@ -59,7 +59,7 @@
       "injection.inner_html": 95,
       "network.fetch": 126,
       "network.http_client": 12,
-      "network.supabase_client": 63,
+      "network.supabase_client": 64,
       "network.websocket": 24,
       "secrets.identifiers": 55,
       "sql.rls": 371,
@@ -310,8 +310,8 @@
     {
       "path": ".github/workflows/codeql.yml",
       "source": "git-tracked",
-      "sha256": "2a0c9eb1703c8f40a55c3f9047144705ff13269792569c444990e917ab65ac42",
-      "size": 1154,
+      "sha256": "b1d3651761559f3c0add740d345b04ca856e19d0e0ec4d51cc310c61bccab34a",
+      "size": 1163,
       "type": "yaml",
       "text": true,
       "classification": "authored:configuration",
@@ -12669,8 +12669,8 @@
     {
       "path": "scripts/patch-lhci-js-yaml.mjs",
       "source": "git-tracked",
-      "sha256": "ab89a38940aca04dbe5866a8fbc6b171a7e8f248d92135377327d31c6f3524dc",
-      "size": 571,
+      "sha256": "0402e6cbf43f3e7ca392d5cff4423c62fef05774ba3a2ab0332b5f8a42e92ef3",
+      "size": 816,
       "type": "javascript",
       "text": true,
       "classification": "authored:tooling",
@@ -13275,8 +13275,8 @@
     {
       "path": "scripts/verify-supabase-security.mjs",
       "source": "git-tracked",
-      "sha256": "e9a3e1d71fbeb2ce7b27d34cd29ff549882f51a69c5a2a74e4a282e90f972c64",
-      "size": 19998,
+      "sha256": "e1f29387c4578f50f170baa67e0037e67091f46123c04239efaf058836629f89",
+      "size": 20294,
       "type": "javascript",
       "text": true,
       "classification": "authored:tooling",
@@ -13309,7 +13309,7 @@
         },
         {
           "id": "network.supabase_client",
-          "count": 1
+          "count": 2
         },
         {
           "id": "secrets.identifiers",

scripts/patch-lhci-js-yaml.mjs

@@ -2,15 +2,27 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 const target = path.resolve('node_modules/@lhci/utils/src/lighthouserc.js');
-if (!fs.existsSync(target)) process.exit(0);
+let handle;
+try {
+  handle = fs.openSync(target, 'r+');
+} catch (error) {
+  if (error?.code === 'ENOENT') process.exit(0);
+  throw error;
+}
 
-const source = fs.readFileSync(target, 'utf8');
-const oldCall = 'yaml.safeLoad(contents)';
-const newCall = '(yaml.load || yaml.safeLoad)(contents)';
+try {
+  const source = fs.readFileSync(handle, 'utf8');
+  const oldCall = 'yaml.safeLoad(contents)';
+  const newCall = '(yaml.load || yaml.safeLoad)(contents)';
 
-if (source.includes(newCall)) process.exit(0);
-if (!source.includes(oldCall)) {
-  throw new Error('Unsupported @lhci/utils lighthouserc parser; update the compatibility patch');
+  if (source.includes(newCall)) {
+    // Already patched by an earlier install.
+  } else if (!source.includes(oldCall)) {
+    throw new Error('Unsupported @lhci/utils lighthouserc parser; update the compatibility patch');
+  } else {
+    fs.ftruncateSync(handle, 0);
+    fs.writeSync(handle, source.replace(oldCall, newCall), 0, 'utf8');
+  }
+} finally {
+  fs.closeSync(handle);
 }
-
-fs.writeFileSync(target, source.replace(oldCall, newCall));

scripts/verify-supabase-security.mjs

@@ -3,7 +3,13 @@ import crypto from 'crypto';
 import { loadEnv } from './storage-backup-lib.mjs';
 
 const env = loadEnv();
-const base = env.SUPABASE_URL?.replace(/\/$/, '');
+const expectedBase = 'https://vteqquoqvksshmfhuepu.supabase.co';
+const configuredBase = env.SUPABASE_URL?.replace(/\/$/, '');
+if (configuredBase && configuredBase !== expectedBase) {
+  console.error(`Refusing to run the production security proof against unexpected project URL: ${configuredBase}`);
+  process.exit(1);
+}
+const base = expectedBase;
 const service = env.SUPABASE_SECRET_KEY || env.SUPABASE_SERVICE_ROLE_KEY;
 const anon = env.SUPABASE_ANON_KEY;