Add CodeQL analysis workflow configuration#36
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow (.github/workflows/codeql.yml) named "CodeQL Advanced" that triggers on pushes/PRs to main, weekly schedule, and manual dispatch; it runs an ChangesCodeQL Workflow Setup
Sequence Diagram(s)sequenceDiagram
participant GitHub as "GitHub Trigger"
participant Runner as "ubuntu-latest Runner"
participant Checkout as "actions/checkout"
participant CodeQLInit as "codeql-action/init@v4"
participant CodeQLAnalyze as "codeql-action/analyze@v4"
GitHub->>Runner: push/PR/cron/dispatch
Runner->>Checkout: checkout repository
Runner->>CodeQLInit: init with matrix languages & build-mode
CodeQLInit->>CodeQLAnalyze: prepare DB & queries for language
CodeQLAnalyze->>Runner: run analysis & upload results
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
|
| Filename | Overview |
|---|---|
| .github/workflows/codeql.yml | New CodeQL workflow covering actions, javascript-typescript, and rust; uses correct action versions and minimal permissions; Rust analysis quality may be limited by build-mode: none (already flagged in prior review threads). |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A([Trigger]) --> B{Event type}
B -->|push to main| C[Start analyze job]
B -->|pull_request targeting main| C
B -->|schedule: weekly Tue 19:34| C
B -->|workflow_dispatch| C
C --> D[Matrix strategy\nfail-fast: false]
D --> E1[language: actions\nbuild-mode: none]
D --> E2[language: javascript-typescript\nbuild-mode: none]
D --> E3[language: rust\nbuild-mode: none]
E1 --> F1[Checkout @ v6]
E2 --> F2[Checkout @ v6]
E3 --> F3[Checkout @ v6]
F1 --> G1[CodeQL init @ v4]
F2 --> G2[CodeQL init @ v4]
F3 --> G3[CodeQL init @ v4]
G1 --> H1[CodeQL analyze @ v4]
G2 --> H2[CodeQL analyze @ v4]
G3 --> H3[CodeQL analyze @ v4]
H1 --> I[Post results to GitHub Security tab]
H2 --> I
H3 --> I
Reviews (3): Last reviewed commit: "fix(codeql): use supported Rust build mo..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 16-18: The YAML uses flow-style brackets with extra spaces in the
"branches: [ \"main\" ]" entries which triggers yamllint errors; edit the
workflow file to remove the inner spaces so both occurrences of the branches key
use "branches: [\"main\"]" (update the lines containing the branches entries in
the codeql.yml so they match the corrected bracket spacing).
- Around line 62-63: Replace floating action tags with immutable commit SHAs:
locate each occurrence of the action references (e.g., the uses:
actions/checkout@v4 entry and the other uses: ...@v4 entries in this workflow)
and replace the `@v4` tag with the corresponding full commit SHA from that
action's releases page (for example, actions/checkout and github/codeql-action).
Update each uses: line so it references the full SHA string instead of a
floating tag to ensure reproducible CI behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6e6e2f83-3bdc-468c-bef0-3214ce3a4093
📒 Files selected for processing (1)
.github/workflows/codeql.yml
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to run GitHub CodeQL “advanced” code scanning on main pushes/PRs and on a weekly schedule, to improve automated security and quality analysis for the repository.
Changes:
- Introduces
.github/workflows/codeql.ymlto run CodeQL analysis for Actions, JavaScript/TypeScript, and Rust. - Configures a language/build-mode matrix and standard CodeQL init/analyze steps.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Replace the generated CodeQL template with a maintained advanced setup workflow that analyzes GitHub Actions, JavaScript/TypeScript, and Rust on pushes, pull requests, schedules, and manual dispatches. Co-authored-by: Codex <noreply@openai.com>
Keep Rust on CodeQL's supported none build mode after the advanced workflow reported that autobuild is not supported for Rust in the current CodeQL bundle. Co-authored-by: Codex <noreply@openai.com>
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/codeql.yml (1)
35-45:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPin action refs to immutable SHAs (not floating major tags).
Line 36, Line 39, and Line 45 use movable tags (
@v6,@v4). That allows CI behavior to change without a PR when upstream tags move. Pin eachuses:reference to a full commit SHA.Suggested change
- - name: Checkout repository - uses: actions/checkout@v6 + - name: Checkout repository + uses: actions/checkout@<checkout_v6_commit_sha> - - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + - name: Initialize CodeQL + uses: github/codeql-action/init@<codeql_action_v4_commit_sha> - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@<codeql_action_v4_commit_sha>#!/bin/bash set -euo pipefail # 1) Verify floating action tags still exist in this workflow. # Expected after fix: no output. rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+){0,2}\s*$' .github/workflows/codeql.yml || true # 2) Resolve current commit SHAs for major tags (read-only, GitHub API). fetch_commit_sha () { local repo="$1" local tag="$2" local ref_json obj_type obj_sha ref_json="$(curl -fsSL "https://api.github.com/repos/${repo}/git/ref/tags/${tag}")" obj_type="$(printf '%s' "$ref_json" | jq -r '.object.type')" obj_sha="$(printf '%s' "$ref_json" | jq -r '.object.sha')" if [[ "$obj_type" == "tag" ]]; then curl -fsSL "https://api.github.com/repos/${repo}/git/tags/${obj_sha}" | jq -r '.object.sha' else printf '%s\n' "$obj_sha" fi } echo "actions/checkout@v6 commit SHA: $(fetch_commit_sha actions/checkout v6)" echo "github/codeql-action@v4 commit SHA: $(fetch_commit_sha github/codeql-action v4)"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml around lines 35 - 45, Replace the floating action tags with immutable commit SHAs for each "uses:" entry so the workflow behavior can't change silently; specifically update the three references "actions/checkout@v6", "github/codeql-action/init@v4" and "github/codeql-action/analyze@v4" to their corresponding full commit SHAs (you can resolve them via the GitHub API or the provided fetch_commit_sha script) and commit the updated .github/workflows/codeql.yml with the pinned SHAs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/codeql.yml:
- Around line 35-45: Replace the floating action tags with immutable commit SHAs
for each "uses:" entry so the workflow behavior can't change silently;
specifically update the three references "actions/checkout@v6",
"github/codeql-action/init@v4" and "github/codeql-action/analyze@v4" to their
corresponding full commit SHAs (you can resolve them via the GitHub API or the
provided fetch_commit_sha script) and commit the updated
.github/workflows/codeql.yml with the pinned SHAs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: a23a131f-534f-4619-a00a-2a613e4f235f
📒 Files selected for processing (1)
.github/workflows/codeql.yml
nisavid
dismissed
coderabbitai[bot]’s stale review
Stale CodeRabbit review: the actionable YAML spacing comments were fixed, action pinning is intentionally not adopted because this repo follows major-version action tags and CodeQL documents that major tags are recommended for advanced setups, and all current checks pass.
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
Summary by CodeRabbit