pnp
diff --git a/‎.github/workflows/builddocsite.yml
Lines changed: 5 additions & 0 deletions b/‎.github/workflows/builddocsite.yml
Lines changed: 5 additions & 0 deletions
diff --git a/‎.github/workflows/buildexternalhelp.yml
Lines changed: 2 additions & 0 deletions b/‎.github/workflows/buildexternalhelp.yml
Lines changed: 2 additions & 0 deletions
diff --git a/‎.github/workflows/buildpr.yml
Lines changed: 5 additions & 7 deletions b/‎.github/workflows/buildpr.yml
Lines changed: 5 additions & 7 deletions
diff --git a/‎.github/workflows/checkdocumentationbuild.yml
Lines changed: 3 additions & 0 deletions b/‎.github/workflows/checkdocumentationbuild.yml
Lines changed: 3 additions & 0 deletions
diff --git a/‎.github/workflows/cleanupnightlyreleases.yml
Lines changed: 2 additions & 0 deletions b/‎.github/workflows/cleanupnightlyreleases.yml
Lines changed: 2 additions & 0 deletions
diff --git a/‎.github/workflows/closestaleissues.yml
Lines changed: 2 additions & 0 deletions b/‎.github/workflows/closestaleissues.yml
Lines changed: 2 additions & 0 deletions
diff --git a/‎.github/workflows/codeql.yml
Lines changed: 62 additions & 0 deletions b/‎.github/workflows/codeql.yml
Lines changed: 62 additions & 0 deletions
diff --git a/‎.github/workflows/nightlyrelease.yml
Lines changed: 6 additions & 3 deletions b/‎.github/workflows/nightlyrelease.yml
Lines changed: 6 additions & 3 deletions
diff --git a/‎.github/workflows/release.yml
Lines changed: 4 additions & 1 deletion b/‎.github/workflows/release.yml
Lines changed: 4 additions & 1 deletion
diff --git a/‎.github/workflows/scorecard.yml
Lines changed: 58 additions & 0 deletions b/‎.github/workflows/scorecard.yml
Lines changed: 58 additions & 0 deletions
@@ -4,9 +4,14 @@ on:
   workflow_dispatch:
   schedule:
   - cron: '0 2 * * *'
+
+permissions: read-all
+
 jobs:
   documentation:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write      
     steps:
       - name: Wait for actions to finish
         uses: softprops/turnstyle@v1
 
@@ -7,6 +7,8 @@ on:
       - dev
     paths: 'documentation/**'
 
+permissions: read-all
+
 jobs:
   build:
 
 
@@ -7,14 +7,12 @@ on:
       - dev
     paths: 
       - 'src/**'
-  #push: 
-  #  branches:
-  #    - dev
-  #  paths:
-  #    - 'src/**'
+  
+permissions: read-all
+
 jobs:
   build_dev_branch:
-    runs-on: ubuntu-latest
+    runs-on: macos-latest
     steps:
     - name: Checkout PnP.Framework
       uses: actions/checkout@v4
@@ -55,5 +53,5 @@ jobs:
       run: dotnet restore -p:PnPFrameworkPath="..\..\..\pnpframework\src\lib\" -p:PnPCoreSdkPath="..\..\..\pnpcore\src\sdk\"
       working-directory: powershell/src
     - name: Build PnP.PowerShell
-      run: dotnet build --configuration Debug --no-restore -p:PnPFrameworkPath="/home/runner/work/powershell/powershell/pnpframework/src/lib/" -p:PnPCoreSdkPath="/home/runner/work/powershell/powershell/pnpcore/src/sdk/"
+      run: dotnet build --configuration Debug --no-restore -p:PnPFrameworkPath="/Users/runner/work/powershell/powershell/pnpframework/src/lib/" -p:PnPCoreSdkPath="/Users/runner/work/powershell/powershell/pnpcore/src/sdk/"
       working-directory: powershell/src
@@ -7,6 +7,9 @@ on:
     paths:
       - 'documentation/**'
       - 'pages/**'
+
+permissions: read-all
+
 jobs:
   docfx:
 
 
@@ -4,6 +4,8 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '0 3 * * *'
+
+permissions: read-all
 
 jobs:
   # This workflow contains a single job called "cleanup"
 
@@ -3,6 +3,8 @@ on:
   schedule:
   - cron: "30 1 * * *"
 
+permissions: read-all
+
 jobs:
   stale:
     runs-on: ubuntu-latest
 
@@ -0,0 +1,62 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ dev ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ dev ]
+  schedule:
+    - cron: '36 19 * * 2'
+
+permissions: read-all
+  
+
+jobs:  
+  analyze:
+    name: Analyze
+    runs-on: windows-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'csharp' ]        
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}            
+
+    - name: Setup .NET Core
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: | 
+          6.x
+          7.x          
+    - name: Install dependencies
+      run: dotnet restore
+      working-directory: src/Commands
+    - name: Build ⚙
+      run:  dotnet build PnP.PowerShell.csproj --nologo --configuration debug --no-incremental --verbosity diagnostic --disable-build-servers --force
+      working-directory: src/Commands  
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
@@ -4,6 +4,9 @@ on:
   workflow_dispatch:
   schedule:
   - cron: '30 2 * * *'
+
+permissions: read-all
+
 jobs:
   build:
 
@@ -73,14 +76,14 @@ jobs:
     - name: Build an image
       run: |
         VERSION=$(cat ./version.txt)-nightly
-        docker build --build-arg "PNP_MODULE_VERSION=$VERSION" --build-arg "BASE_IMAGE_SUFFIX=alpine-3.14" --build-arg "INSTALL_USER=root" --build-arg "SKIP_PUBLISHER_CHECK=False" ./docker -f ./docker/pnppowershell.dockerFile --tag ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.14;
+        docker build --build-arg "PNP_MODULE_VERSION=$VERSION" --build-arg "BASE_IMAGE_SUFFIX=alpine-3.17" --build-arg "INSTALL_USER=root" --build-arg "SKIP_PUBLISHER_CHECK=False" ./docker -f ./docker/pnppowershell.dockerFile --tag ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.17;
     - name: Tag the image
       run: |
         VERSION=$(cat ./version.txt)-nightly
-        docker image tag ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.14 ${{ secrets.DOCKER_ORG }}/powershell:nightly
+        docker image tag ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.17 ${{ secrets.DOCKER_ORG }}/powershell:nightly
     - name: Push the image
       run: |
         VERSION=$(cat ./version.txt)-nightly
         docker login -u ${{ secrets.DOCKER_USERNAME }} -p '${{ secrets.DOCKER_PASSWORD }}'
-        docker push ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.14
+        docker push ${{ secrets.DOCKER_ORG }}/powershell:$VERSION-alpine-3.17
         docker push ${{ secrets.DOCKER_ORG }}/powershell:nightly
@@ -4,6 +4,9 @@ on:
   workflow_dispatch:
   schedule:
   - cron: '30 3 * * *'
+
+permissions: read-all
+  
 jobs:
   publish-docker-windows-2022:
     runs-on: windows-2022
@@ -31,4 +34,4 @@ jobs:
       shell: pwsh
       run: |
         $securedPassword = ConvertTo-SecureString "${{ secrets.DOCKER_PASSWORD }}" -AsPlainText -Force
-        ./docker/Publish-UnpublishedImage.ps1 PnP.PowerShell ${{ secrets.DOCKER_USERNAME }} ${{ secrets.DOCKER_ORG }} powershell $securedPassword "root" $false "alpine-3.14"
+        ./docker/Publish-UnpublishedImage.ps1 PnP.PowerShell ${{ secrets.DOCKER_USERNAME }} ${{ secrets.DOCKER_ORG }} powershell $securedPassword "root" $false "alpine-3.17"
@@ -0,0 +1,58 @@
+name: Scorecard analysis workflow
+on:
+  push:
+    # Only the default branch is supported.
+    branches:
+    - dev
+  schedule:
+    # Weekly on Saturdays.
+    - cron:  '30 1 * * 6'
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed for Code scanning upload
+      security-events: write
+      # Needed for GitHub OIDC token if publish_results is true
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+        with:          
+          ref: ${{ github.event.inputs.branch }}
+          path: ${{ github.sha }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # Scorecard team runs a weekly scan of public GitHub repos,
+          # see https://github.com/ossf/scorecard#public-data.
+          # Setting `publish_results: true` helps us scale by leveraging your workflow to
+          # extract the results instead of relying on our own infrastructure to run scans.
+          # And it's free for you!
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable
+      # uploads of run results in SARIF format to the repository Actions tab.
+      # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@8f596b4ae3cb3c588a5c46780b86dd53fef16c52 # v3.25.2
+        with:
+          sarif_file: results.sarif