From a1aa688e13f7103de652a499c530f4753548e7c5 Mon Sep 17 00:00:00 2001 From: Boris Batkin Date: Thu, 11 Jun 2026 15:47:47 -0700 Subject: [PATCH 1/2] =?UTF-8?q?CI:=20revive=20CodeQL=20=E2=80=94=20v3=20ac?= =?UTF-8?q?tion,=20build-mode=20none,=20wired=20to=20PRs=20+=20weekly=20cr?= =?UTF-8?q?on?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The existing codeql.yml was the stock template parked on workflow_dispatch-only: it never triggered automatically, ran a full cpp Autobuild per language, and sits on codeql-action@v2, which GitHub has since sunset — even a manual dispatch fails today. Rewritten: c-cpp only (.das is invisible to CodeQL and is covered by the in-tree lint; the template's javascript/python lanes scanned a few scripts for the price of two more jobs), build-mode none instead of Autobuild (no traced build — minutes per run, not a full build; can be upgraded later if finding quality warrants), vendored 3rdparty/ and tests-cpp/3rdparty/ excluded from analysis. Triggers: PRs and master pushes path-filtered to the C++ surface, a weekly cron to keep the master baseline fresh for PR alert diffing, and workflow_dispatch kept for manual full runs. PR checks flag only alerts NEW in the diff; the first-scan backlog lands in the Security tab without gating anything. Co-Authored-By: Claude Fable 5 --- .github/workflows/codeql.yml | 87 ++++++++++++++++-------------------- 1 file changed, 39 insertions(+), 48 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d9e8370736..0aa40c3729 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,70 +1,61 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# name: "CodeQL" +# CodeQL static analysis over the C++ surface (src, include, modules, +# tests-cpp). build-mode none — no traced build, so a run costs minutes, not a +# full build per PR; switch to a built mode only if finding quality ever +# warrants it. PR checks flag NEW alerts only; the pre-existing backlog lives +# in the Security tab and does not gate PRs. .das files are invisible to +# CodeQL — that surface is covered by the in-tree lint. + on: + push: + branches: [master] + paths: + - 'src/**' + - 'include/**' + - 'modules/**' + - 'tests-cpp/**' + - '.github/workflows/codeql.yml' + pull_request: + branches: [master] + paths: + - 'src/**' + - 'include/**' + - 'modules/**' + - 'tests-cpp/**' + - '.github/workflows/codeql.yml' + schedule: + # weekly full refresh keeps the master baseline current even when no + # C++-touching push happens (PR alert diffing compares against it) + - cron: '20 3 * * 1' workflow_dispatch: jobs: analyze: - name: Analyze + name: analyze (c-cpp) runs-on: ubuntu-latest-fat + timeout-minutes: 90 permissions: actions: read contents: read security-events: write - strategy: - fail-fast: false - matrix: - language: [ 'cpp', 'javascript', 'python' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] - # Use only 'java' to analyze code written in Java, Kotlin or both - # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support - steps: - name: Checkout repository uses: actions/checkout@v4 - # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@v3 with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality - - - # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v2 - - # ℹ️ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - # If the Autobuild fails above, remove it and uncomment the following three lines. - # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - - # - run: | - # echo "Run, Build Application using script" - # ./location_of_script_within_repo/buildscript.sh + languages: c-cpp + build-mode: none + # vendored code — findings there are not actionable here + config: | + paths-ignore: + - 3rdparty + - tests-cpp/3rdparty - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@v3 with: - category: "/language:${{matrix.language}}" + category: "/language:c-cpp" From 98531485cf7d395062e84261888f930620ef93a6 Mon Sep 17 00:00:00 2001 From: Boris Batkin Date: Thu, 11 Jun 2026 15:52:25 -0700 Subject: [PATCH 2/2] =?UTF-8?q?codeql:=20skip=20fork=20PRs=20=E2=80=94=20r?= =?UTF-8?q?ead-only=20GITHUB=5FTOKEN=20can't=20upload=20SARIF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fork PRs get a read-only token regardless of the permissions block, so the analyze step's SARIF upload would red-check every external contributor's C++ PR. Same-repo PRs and push/schedule/dispatch still run; fork-contributed code gets scanned by the post-merge master push. Co-Authored-By: Claude Fable 5 --- .github/workflows/codeql.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0aa40c3729..d0949af00e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -33,6 +33,9 @@ on: jobs: analyze: name: analyze (c-cpp) + # fork PRs get a read-only GITHUB_TOKEN, so the SARIF upload would fail — + # skip them; the post-merge master push scans their code anyway + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest-fat timeout-minutes: 90 permissions: