Add CodeQL#201
Conversation
WalkthroughAdds a new GitHub Actions workflow (.github/workflows/codeql.yml) named “CodeQL Advanced” to run CodeQL analysis on push, pull_request to main, and a weekly cron. It defines a single matrix job over languages (actions, python), initializes CodeQL with build-mode none, and runs the analyze step with appropriate permissions. Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant GH as GitHub Actions
participant Init as CodeQL Init Action
participant Build as Build-Mode Check
participant Analyze as CodeQL Analyze Action
participant Sec as Security Events
Dev->>GH: Push/PR to main or weekly cron
GH->>Init: Initialize CodeQL (language matrix, build-mode: none)
Init-->>GH: Setup complete
GH->>Build: Check for manual build-mode
Build-->>GH: Skip (build-mode none)
GH->>Analyze: Run CodeQL analyze with category
Analyze-->>Sec: Upload SARIF security results
Estimated code review effort🎯 2 (Simple) | ⏱️ ~7 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
.github/workflows/codeql.yml (5)
14-21: Add manual trigger for operational flexibility (workflow_dispatch)Enabling manual runs is useful for ad-hoc investigations or validating CodeQL config changes without pushing/PRs.
Apply this diff to add a manual trigger:
on: push: branches: [ "main" ] pull_request: branches: [ "main" ] schedule: - cron: '23 23 * * 6' + workflow_dispatch:
30-30: Simplify runs-on expressionSince the matrix currently contains only actions and python, the Swift condition is unnecessary noise. Simplify to ubuntu-latest.
- runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + runs-on: ubuntu-latest
31-41: Tighten permissions slightly (drop packages: read unless using private CodeQL packs)If you aren't pulling private packs from GitHub Packages, you can remove packages: read to reduce scope. Keep contents: read (needed for checkout) and actions: read (needed for Actions analysis, especially in private repos).
permissions: # required for all workflows security-events: write - # required to fetch internal or private CodeQL packs - packages: read - # only required for workflows in private repositories actions: read contents: read
59-61: Fetch more history for better PR baselinesFetching at least the merge base improves CodeQL’s ability to attribute and suppress alerts accurately on pull requests.
- name: Checkout repository uses: actions/checkout@v4 + with: + # Fetch enough history to compute accurate PR baselines (0 = full history) + fetch-depth: 2
68-80: Enable extended and quality queriesBroaden coverage by including security-extended and security-and-quality query suites. Prefix with + to merge with any future config file.
with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} # If you wish to specify custom queries, you can do so here or in a config file. # By default, queries listed here will override any specified in a config file. # Prefix the list here with "+" to use these queries and those in the config file. # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality + queries: +security-extended,security-and-quality
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/codeql.yml(1 hunks)
🔇 Additional comments (3)
.github/workflows/codeql.yml (3)
22-29: Solid baseline: matrix job, least-privilege permissions, and v3 CodeQL actions look goodNice, clean setup for multi-language analysis with sensible defaults. Using v3 actions and job-level permissions is aligned with current best practices.
97-101: Analyze step is correctly configuredCategory scoping per language and v3 action are correct.
42-50: CodeQL matrix OK — only Actions + Python neededScanned the repo: 12 Python files; 0 JavaScript/TypeScript, Go, Ruby, Java/Kotlin, C/C++, Rust, or Swift files. No package.json/package-lock.json/yarn.lock/pnpm-lock.yaml/tsconfig.json/go.mod/Cargo.toml/pom.xml/build.gradle(.kts)/Gemfile/Package.swift found.
- Workflows present: .github/workflows/container.yml, .github/workflows/test.yml, .github/workflows/codeql.yml
- File under review: .github/workflows/codeql.yml — current matrix (actions + python) is correct; no changes required.
2 participants
Summary by CodeRabbit