tag: Security-Scanning · 4 items
- Platform/SRE — Skip
- CI/CD — Learn: Dependabot alert lifecycle (withdrawn vs. active) is relevant to supply-chain workflows, and understanding when alerts are auto-removed helps CI/CD engineers avoid chasing invalid findings — but no pipeline changes or deadlines are involved.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: Pipelines that download codeql-bundle.tar.gz or .tar.zst need to migrate to platform-specific CodeQL bundles; no hard removal date announced yet, so audit your CodeQL download steps and update references to the appropriate per-platform bundle this quarter.
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found)
- Platform/SRE — Skip
- CI/CD — Plan: If your pipelines run CodeQL on ARM64 Linux runners, upgrading to 2.27.0 unlocks native support; also worth evaluating the new Rust security query and expanded Java/Kotlin and C# framework coverage for any affected repositories.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: GitLab’s improved Scope+Offset fingerprinting reduces duplicate vulnerability findings from reformats and comment additions; worth knowing when evaluating SAST signal quality in GitLab pipelines, but no pipeline change is needed today.
- Leader — Skip