ci(codeql): switch to advanced setup so fork PRs are scanned#708
Merged
Conversation
Default setup does not analyze pull requests from forks, so the code_scanning ruleset rule blocks every fork PR. Add an advanced-setup CodeQL workflow (build-mode: none for all 6 languages) that runs on pull_request, so fork PRs are scanned and the gate is satisfiable without admin bypass. Document the workflow in .github/workflows/README.md.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds an advanced CodeQL GitHub Actions workflow plus README docs. The workflow is gated by repository variable ChangesCodeQL Security Scanning
sequenceDiagram
participant GitHub as GitHub Actions
participant Runner as Actions Runner
participant Checkout as actions/checkout@v3
participant Init as github/codeql-action/init@v4
participant Analyze as github/codeql-action/analyze@v4
GitHub->>Runner: trigger (push|pull_request|workflow_dispatch|cron)
Runner->>Checkout: checkout repository
Runner->>Init: init CodeQL (matrix.language, build-mode)
Init->>Analyze: provide CodeQL DB/config
Runner->>Analyze: run analysis (category=/language:${matrix.language})
Analyze->>GitHub: upload analysis results
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/codeql.yml (2)
48-49: ⚡ Quick winConsider setting
persist-credentials: falsefor defense in depth.The checkout step does not disable credential persistence. While the risk is minimal in this workflow (no custom
run:steps that could misuse credentials), settingpersist-credentials: falseis a security best practice.🔒 Proposed fix to disable credential persistence
- name: Checkout uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml around lines 48 - 49, The Checkout step using actions/checkout@v4 currently leaves credential persistence enabled; update the checkout step (the step named "Checkout" that uses actions/checkout@v4) to explicitly set persist-credentials: false to prevent the action from leaving GITHUB_TOKEN credentials available to later steps for defense in depth.Source: Linters/SAST tools
49-49: Pin CodeQL workflow actions to commit SHAs for supply-chain hardening
.github/workflows/codeql.ymlcurrently uses tag-based actions:
actions/checkout@v4→actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5github/codeql-action/init@v3→github/codeql-action/init@b0c4fd77f6c559021d78430ec4d0d169ae74a4ebgithub/codeql-action/analyze@v3→github/codeql-action/analyze@b0c4fd77f6c559021d78430ec4d0d169ae74a4ebNo repo policy requiring SHA pinning for GitHub Actions was found; this is a security best practice rather than a hard requirement.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml at line 49, Update the CodeQL workflow to pin the GitHub Actions to specific commit SHAs instead of tags: replace uses: actions/checkout@v4 with uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, replace github/codeql-action/init@v3 with github/codeql-action/init@b0c4fd77f6c559021d78430ec4d0d169ae74a4eb, and replace github/codeql-action/analyze@v3 with github/codeql-action/analyze@b0c4fd77f6c559021d78430ec4d0d169ae74a4eb so the CodeQL workflow uses commit-pinned actions for supply-chain hardening.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/codeql.yml:
- Around line 48-49: The Checkout step using actions/checkout@v4 currently
leaves credential persistence enabled; update the checkout step (the step named
"Checkout" that uses actions/checkout@v4) to explicitly set persist-credentials:
false to prevent the action from leaving GITHUB_TOKEN credentials available to
later steps for defense in depth.
- Line 49: Update the CodeQL workflow to pin the GitHub Actions to specific
commit SHAs instead of tags: replace uses: actions/checkout@v4 with uses:
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5, replace
github/codeql-action/init@v3 with
github/codeql-action/init@b0c4fd77f6c559021d78430ec4d0d169ae74a4eb, and replace
github/codeql-action/analyze@v3 with
github/codeql-action/analyze@b0c4fd77f6c559021d78430ec4d0d169ae74a4eb so the
CodeQL workflow uses commit-pinned actions for supply-chain hardening.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 19513104-99fc-44a6-8450-c2df9fd6f243
📒 Files selected for processing (2)
.github/workflows/README.md.github/workflows/codeql.yml
CI showed Analyze (go) fails at init: Go's CodeQL extractor does not support build-mode none. Switch Go to autobuild (the mode default setup uses for this repo); other languages keep build-mode none.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 62-64: Replace the floating tag "uses: actions/checkout@v6" with a
pinned commit SHA for supply-chain security: locate the workflow step that
references actions/checkout@v6 and change it to the specific full revision (the
actions/checkout repository commit SHA) instead of the version tag, ensuring the
workflow still sets with: persist-credentials: false; commit the updated
workflow so the action is locked to the exact commit rather than a moving tag.
- Around line 67-70: Replace the floating major tag usage with an immutable
commit SHA: change uses: github/codeql-action/init@v4 to uses:
github/codeql-action/init@<commit-sha> where <commit-sha> is the specific commit
from the v4 release branch you want to pin, and do the same for uses:
github/codeql-action/analyze@v4 (replace with uses:
github/codeql-action/analyze@<same-commit-sha>); ensure both init and analyze
reference the exact commit SHA taken from the v4 line so you keep the v4
codebase while pinning to an immutable SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2e985e7c-c814-45d0-8167-48f5ac19acd1
📒 Files selected for processing (2)
.github/workflows/README.md.github/workflows/codeql.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/README.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CodeQL default setup does not analyze pull requests from forks. The
main/releaserulesets require CodeQL code scanning results, so fork PRs can remain blocked waiting for results that never arrive.This PR adds a CodeQL advanced-setup workflow that can run on
pull_requestonce default setup is disabled.What
.github/workflows/codeql.ymlwith a matrix over the analyzed languages:actions,c-cpp,go,javascript-typescript,python, andrust.build-mode: nonewhere CodeQL supports source-only analysis.build-mode: autobuildfor Go because Go does not supportnone.github/codeql-action@v4andactions/checkout@v6.persist-credentials: false.CODEQL_ADVANCED_SETUP_ENABLED=truewhile default setup is still enabled..github/workflows/README.md.Required activation after merge
GitHub rejects advanced CodeQL uploads while CodeQL default setup is enabled, so this workflow is intentionally feature-gated for the bootstrap PR.
CODEQL_ADVANCED_SETUP_ENABLEDunset orfalse, leaving default setup as the active scanner.CODEQL_ADVANCED_SETUP_ENABLED=true.CodeQLworkflow dispatch.CODEQL_ADVANCED_SETUP_ENABLED=falseand re-enabling default setup.Validation
actionlint .github/workflows/codeql.ymlgit diff --check origin/main...HEAD -- .github/workflows/README.md .github/workflows/codeql.ymlmake lintSummary by CodeRabbit
Chores
Documentation