workflow-supply-chain-maintenance

name	workflow-supply-chain-maintenance
description	Use when editing GitHub Actions, CodeQL, Dependabot, or workflow-installed tool pins and the repo needs verified current versions and scanner scope discipline.
origin	repo-local, grounded in official GitHub docs and official release sources

Workflow And Supply Chain Maintenance

Use this skill before changing workflow action versions, CodeQL scope, Dependabot policy, or workflow-installed tool versions.

Rules

• Verify workflow action versions from the official GitHub release source, not from examples copied out of old READMEs.
• Verify Python tool versions from the canonical package index before updating pins in workflows or pyproject.toml.
• Keep frozen upstream snapshot directories matching source_code_v*/ excluded from security scanning.
• Prefer a dedicated CodeQL config file for scan scope and query policy so the workflow stays small and future snapshot updates have one source of truth.
• Keep Dependabot enabled for every workflow/package ecosystem actually in use.

Read references/official-guidance.md before changing workflow pins, CodeQL scope, or Dependabot configuration.