From e6aff964db94e534ef48eb04bdc7eea5e3383d0a Mon Sep 17 00:00:00 2001
From: Nick Fyson <nickfyson@github.com>
Date: Wed, 8 Sep 2021 09:54:15 +0100
Subject: [PATCH 1/3] add codeql workflow to ghes

---
 script/sync-ghes/settings.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/script/sync-ghes/settings.json b/script/sync-ghes/settings.json
index eef1700..e4f50fa 100644
--- a/script/sync-ghes/settings.json
+++ b/script/sync-ghes/settings.json
@@ -2,7 +2,8 @@
   "folders": [
     "../../ci",
     "../../automation",
-    "../../deployments"
+    "../../deployments",
+    "../../code-scanning"
   ],
   "enabledActions": [
     "actions/checkout",
@@ -16,7 +17,8 @@
     "actions/stale",
     "actions/starter-workflows",
     "actions/upload-artifact",
-    "actions/upload-release-asset"
+    "actions/upload-release-asset",
+    "github/codeql-action"
   ],
   "partners": [
     "Alibaba Cloud",

From 7aa19443113884c16be2b6c23964c0205bfbdb6e Mon Sep 17 00:00:00 2001
From: Nick Fyson <nickfyson@github.com>
Date: Wed, 8 Sep 2021 10:08:06 +0100
Subject: [PATCH 2/3] only run ghes sync checks on YML files

---
 script/sync-ghes/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/script/sync-ghes/index.ts b/script/sync-ghes/index.ts
index e37eca3..95f70c0 100755
--- a/script/sync-ghes/index.ts
+++ b/script/sync-ghes/index.ts
@@ -45,7 +45,7 @@ async function checkWorkflows(
     });
 
     for (const e of dir) {
-      if (e.isFile()) {
+      if (e.isFile() && extname(e.name) === ".yml") {
         const workflowFilePath = join(folder, e.name);
         const workflowId = basename(e.name, extname(e.name));
         const workflowProperties: WorkflowProperties = require(join(

From c2cc54a69e8f66b42dbbc3f29898787dba75c896 Mon Sep 17 00:00:00 2001
From: Nick Fyson <nickfyson@github.com>
Date: Wed, 8 Sep 2021 10:28:14 +0100
Subject: [PATCH 3/3] only check nwo of supported actions

---
 script/sync-ghes/index.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/script/sync-ghes/index.ts b/script/sync-ghes/index.ts
index 95f70c0..9edc70e 100755
--- a/script/sync-ghes/index.ts
+++ b/script/sync-ghes/index.ts
@@ -58,7 +58,7 @@ async function checkWorkflows(
         const isPartnerWorkflow = workflowProperties.creator ? partnersSet.has(workflowProperties.creator.toLowerCase()) : false;
 
         const enabled =
-        !isPartnerWorkflow &&
+          !isPartnerWorkflow &&
           (await checkWorkflow(workflowFilePath, enabledActions));
 
         const workflowDesc: WorkflowDesc = {
@@ -104,7 +104,8 @@ async function checkWorkflow(
         if (!!step.uses) {
           // Check if allowed action
           const [actionName, _] = step.uses.split("@");
-          if (!enabledActionsSet.has(actionName.toLowerCase())) {
+          const actionNwo = actionName.split("/").slice(0, 2).join("/");
+          if (!enabledActionsSet.has(actionNwo.toLowerCase())) {
             console.info(
               `Workflow ${workflowPath} uses '${actionName}' which is not supported for GHES.`
             );