Add Clippy SARIF code scanning#37
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that runs cargo clippy (workspace/all targets), converts JSON output to SARIF via clippy-sarif and sarif-fmt, caches those tools, and uploads the SARIF to GitHub Code Scanning on pushes/PRs to main, scheduled runs, and manual dispatch. ChangesRust Clippy CI Workflow
Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub Actions
participant Runner as ubuntu-latest
participant Clippy as cargo clippy
participant Converter as clippy-sarif & sarif-fmt
participant Upload as upload-sarif@v4
GitHub->>Runner: start clippy-sarif job
Runner->>Clippy: install clippy component / run `cargo clippy --message-format=json --workspace --all-targets`
Clippy->>Converter: stream JSON messages
Converter->>Runner: write `rust-clippy-results.sarif`
Runner->>Upload: upload `rust-clippy-results.sarif` (wait-for-processing)
Upload->>GitHub: register code scanning results
🎯 2 (Simple) | ⏱️ ~10 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
|
| Filename | Overview |
|---|---|
| .github/workflows/rust-clippy.yml | New Clippy SARIF scanning workflow; correctly pins versions, caches SARIF tools, guards SARIF upload against fork PRs, and is structurally consistent with the existing codeql.yml. |
Sequence Diagram
sequenceDiagram
participant GH as GitHub Event
participant Checkout as actions/checkout
participant Rustup as rustup
participant Cache as actions/cache
participant CargoInstall as cargo install
participant Clippy as cargo clippy
participant SARIF as clippy-sarif / sarif-fmt
participant Upload as upload-sarif
GH->>Checkout: trigger workflow
Checkout->>Rustup: rustup component add clippy
Rustup->>Cache: restore ~/.cargo/bin/clippy-sarif and sarif-fmt
alt cache miss
Cache->>CargoInstall: cargo install --locked clippy-sarif sarif-fmt
end
Rustup->>Clippy: "cargo clippy --workspace --all-targets --message-format=json"
Clippy->>SARIF: "JSON diagnostics piped to clippy-sarif | tee | sarif-fmt"
SARIF-->>SARIF: writes rust-clippy-results.sarif
alt not fork PR
SARIF->>Upload: "github/codeql-action/upload-sarif@v4"
end
Reviews (3): Last reviewed commit: "ci(clippy): add SARIF code scanning" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions workflow intended to run Rust Clippy and upload results to GitHub as SARIF for code scanning visibility.
Changes:
- Introduces
.github/workflows/rust-clippy.ymlto runcargo clippyand convert JSON output into SARIF. - Uploads the generated
rust-clippy-results.sarifviagithub/codeql-action/upload-sarif@v3.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f413a9a041
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/rust-clippy.yml (1)
51-56:⚠️ Potential issue | 🟠 Major | ⚡ Quick winGuard SARIF upload for forked pull requests.
Fork pull requests have read-only permissions for
security-events, causing SARIF upload to fail. Add a conditional to skip upload for forked PRs while allowing uploads on push, schedule, and non-fork pull requests.Suggested change
- name: Upload analysis results to GitHub + if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) }} uses: github/codeql-action/upload-sarif@v3 with: sarif_file: rust-clippy-results.sarif wait-for-processing: true🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/rust-clippy.yml around lines 51 - 56, The workflow step "Upload analysis results to GitHub" (uses: github/codeql-action/upload-sarif@v3, sarif_file: rust-clippy-results.sarif) needs a condition to skip SARIF upload for forked pull requests; add an if: expression such as checking github.event_name and validating the PR repo is the same as the base repo (for example: if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) so uploads run on push/schedule and non-fork PRs but are skipped for forked PRs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/rust-clippy.yml:
- Around line 14-17: The YAML uses spaced array syntax `[ "main" ]` on the
branches keys, which triggers lint errors; replace those with the compact form
`["main"]` for both occurrences under the top-level branches and
pull_request.branches so the entries are parsed without extra spaces and satisfy
the linter (update the two array values that currently read `[ "main" ]`).
- Line 34: The workflow uses the archived action uses:
actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af; replace this with
the maintained action uses: actions-rust-lang/setup-rust-toolchain@v1 and adjust
any action inputs to the new action's names (e.g., map existing
toolchain/profile/component/target inputs to the setup-rust-toolchain
equivalents such as toolchain, profile, components, targets) so the step that
previously referenced actions-rs/toolchain continues to install the correct Rust
toolchain and components.
- Line 42: Update the GitHub Actions step that runs the Cargo installation
command so it uses the --locked flag to ensure deterministic installs;
specifically modify the command that currently runs cargo install clippy-sarif
sarif-fmt to include --locked (i.e., cargo install --locked clippy-sarif
sarif-fmt) so the build uses each crate's locked dependency versions.
---
Outside diff comments:
In @.github/workflows/rust-clippy.yml:
- Around line 51-56: The workflow step "Upload analysis results to GitHub"
(uses: github/codeql-action/upload-sarif@v3, sarif_file:
rust-clippy-results.sarif) needs a condition to skip SARIF upload for forked
pull requests; add an if: expression such as checking github.event_name and
validating the PR repo is the same as the base repo (for example: if:
github.event_name != 'pull_request' ||
github.event.pull_request.head.repo.full_name == github.repository) so uploads
run on push/schedule and non-fork PRs but are skipped for forked PRs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 57d71953-960b-4362-a9b5-43fbd9c3f07e
📒 Files selected for processing (1)
.github/workflows/rust-clippy.yml
nisavid
changed the title
Configure workflow-defined Clippy code scanning alongside the existing warning-enforcing Rust CI gate. Use the repo workspace and all-targets coverage, pin and cache SARIF tools, use rustup directly, and skip SARIF upload for forked pull requests without repository security-event permission. Co-authored-by: Codex <noreply@openai.com>
Summary
--workspace --all-targetswhile leaving warning enforcement in the existing CI workflow.clippy-sarifandsarif-fmt, userustupdirectly, and skip SARIF upload for forked pull requests without repository security-event permission.Verification
python3 -c 'import yaml, pathlib; yaml.safe_load(pathlib.Path(".github/workflows/rust-clippy.yml").read_text()); print("yaml ok")'git diff --checkCo-authored-by: Codex noreply@openai.com
Summary by CodeRabbit