Create codeql.yml - #199
Merged
Merged
Conversation
marlon-costa-dc
enabled auto-merge (squash)
August 10, 2026 23:29
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds a GitHub Actions CodeQL workflow. The workflow runs for selected repository events and weekly. It analyzes Actions, JavaScript/TypeScript, Python, and Rust. ChangesCodeQL workflow
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Contributor
PR Summary by QodoAdd CodeQL Advanced workflow for multi-language security scanning
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 64: Pin all GitHub Actions references in .github/workflows/codeql.yml at
lines 64, 74, and 103 to the specified full commit SHAs: use the checkout SHA
for actions/checkout and the provided CodeQL SHA for both
github/codeql-action/init and github/codeql-action/analyze.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5897b173-80ca-4e92-be5f-990a775de165
📒 Files selected for processing (1)
.github/workflows/codeql.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (7)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Analyze (python)
- GitHub Check: Analyze (actions)
- GitHub Check: Analyze (rust)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: ci
🧰 Additional context used
🪛 zizmor (1.29.0)
.github/workflows/codeql.yml
[warning] 63-72: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 64-64: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 74-74: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 103-103: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 33-33: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[warning] 14-20: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
for action in \
'actions/checkout@v7' \
'github/codeql-action/init@v4' \
'github/codeql-action/analyze@v4'
do
repository="${action%@*}"
ref="${action#*@}"
sha="$(gh api "repos/${repository}/commits/${ref}" --jq '.sha')"
printf '%s@%s\n' "$repository" "$sha"
doneRepository: marlonsc/mcb
Length of output: 233
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- workflow references ---'
cat -n .github/workflows/codeql.yml | sed -n '55,110p'
resolve_tag() {
local repository="$1" tag="$2" ref_json object_type object_sha commit_sha
ref_json="$(gh api "repos/${repository}/git/ref/tags/${tag}")"
object_type="$(jq -r '.object.type' <<<"$ref_json")"
object_sha="$(jq -r '.object.sha' <<<"$ref_json")"
if [[ "$object_type" == tag ]]; then
commit_sha="$(gh api "repos/${repository}/git/tags/${object_sha}" --jq '.object.sha')"
elif [[ "$object_type" == commit ]]; then
commit_sha="$object_sha"
else
printf 'unexpected tag object type: %s\n' "$object_type" >&2
return 1
fi
gh api "repos/${repository}/commits/${commit_sha}" --jq \
'"\(.sha) \(.commit.message | split("\n")[0])"'
}
printf '%s\n' '--- actions/checkout v7 ---'
resolve_tag actions/checkout v7
printf '%s\n' '--- github/codeql-action v4 ---'
resolve_tag github/codeql-action v4Repository: marlonsc/mcb
Length of output: 3731
Pin the GitHub Actions to full commit SHAs.
actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3
🧰 Tools
🪛 zizmor (1.29.0)
[error] 64-64: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
📍 Affects 1 file
.github/workflows/codeql.yml#L64-L64(this comment).github/workflows/codeql.yml#L74-L74.github/workflows/codeql.yml#L103-L103
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 64, Pin all GitHub Actions references
in .github/workflows/codeql.yml at lines 64, 74, and 103 to the specified full
commit SHAs: use the checkout SHA for actions/checkout and the provided CodeQL
SHA for both github/codeql-action/init and github/codeql-action/analyze.
Source: Linters/SAST tools
Contributor
Code Review by Qodo
1. Scheduled scan wrong branch
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+74
to
+77
| uses: github/codeql-action/init@v4 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| build-mode: ${{ matrix.build-mode }} |
Contributor
There was a problem hiding this comment.
2. Codeql config unused 🐞 Bug ⚙ Maintainability
The repo contains a CodeQL configuration file that constrains paths and query behavior, but the new workflow does not reference it and instead selects languages via a matrix. This makes CodeQL results inconsistent with the repo’s existing CodeQL configuration and can expand scanning scope beyond what the config defines.
Agent Prompt
## Issue description
The workflow initializes CodeQL without using the repo’s existing `.github/codeql-config.yml`, so the configured paths/query-filters are not applied.
## Issue Context
`.github/codeql-config.yml` defines `paths`, `paths-ignore`, query pack usage, and filters. The workflow currently provides `languages` via a matrix and does not supply any `config-file` input.
## Fix Focus Areas
- .github/workflows/codeql.yml[44-53]
- .github/workflows/codeql.yml[73-78]
- .github/codeql-config.yml[1-30]
## Suggested change
1. In the `github/codeql-action/init` step, add `config-file: ./.github/codeql-config.yml`.
2. Decide on a single source of truth for languages:
- If the repo intends Rust-only scanning, reduce the matrix to just Rust.
- If the repo intends multi-language scanning, update `.github/codeql-config.yml` accordingly (paths/ignores/queries per language) so the workflow and config remain consistent.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+15
to
+18
| push: | ||
| branches: [ "develop" ] | ||
| pull_request: | ||
| branches: [ "develop" ] |
Contributor
There was a problem hiding this comment.
3. Develop-only event scanning 🐞 Bug ◔ Observability
The CodeQL workflow only runs on push/PR events for the develop branch, so changes targeting other branches used by repo CI (e.g., main/dev) won’t get event-driven CodeQL results. This reduces timely security feedback on those branches (even though the scheduled run still provides periodic scanning).
Agent Prompt
## Issue description
CodeQL is only triggered for `develop` on `push` and `pull_request`, while the repo’s CI runs on additional branches.
## Issue Context
If changes are merged to `main`/`dev` (or PRs target them), this workflow won’t run on those events, reducing near-real-time scanning coverage.
## Fix Focus Areas
- .github/workflows/codeql.yml[14-20]
- .github/workflows/ci.yml[12-25]
## Suggested change
Update `on.push.branches` and `on.pull_request.branches` to include the same branch set as CI (or otherwise explicitly document/encode the intended security-scanning branch policy).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+17
to
+20
| pull_request: | ||
| branches: [ "develop" ] | ||
| schedule: | ||
| - cron: '20 8 * * 6' |
Contributor
There was a problem hiding this comment.
1. Scheduled scan wrong branch 🐞 Bug ☼ Reliability
The weekly schedule run will execute from the repository’s default branch workflow context, but this workflow’s event-driven triggers are scoped to develop, so the scheduled CodeQL run may analyze the default branch rather than develop. In this repo, other workflows gate deploy behavior on refs/heads/main, so without an explicit checkout ref for scheduled events, the weekly scan can diverge from the develop branch you’re targeting on push/PR.
Agent Prompt
### Issue description
The CodeQL workflow runs on a weekly schedule, but scheduled runs use the default-branch workflow context and your checkout step does not pin a ref. This can result in the scheduled scan analyzing the default branch instead of `develop`, while push/PR scans are limited to `develop`.
### Issue Context
This repo appears to treat `main` as a primary branch for deployments (docs workflow gates Pages operations on `refs/heads/main`), so it’s important the scheduled scan matches the intended target branch.
### Fix Focus Areas
- .github/workflows/codeql.yml[14-20]
### Suggested change
Conditionally pin checkout to `develop` for scheduled runs only, leaving push/PR behavior unchanged. For example:
```yml
- name: Checkout repository
uses: actions/checkout@v7
with:
ref: ${{ github.event_name == 'schedule' && 'develop' || github.ref }}
```
(Alternatively, if you want weekly scanning on the default branch, clarify that intention and consider aligning push/PR branch filters accordingly.)
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Contributor
|
Code review by qodo was updated up to the latest commit 55c9ada |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
4 issues found across 1 file
Confidence score: 3/5
- In
.github/workflows/codeql.yml, using mutable action tags (actions/checkout@v7,github/codeql-action/*@v4) and leaving checkout credentials persisted increases supply-chain and token-exposure risk if an upstream tag changes unexpectedly — pin each action to a commit SHA and setpersist-credentials: falseon checkout. - In
.github/workflows/codeql.yml, the CodeQLinitstep does not pass the repository’s.github/codeql-config.yml, so intended query sets and path exclusions may be skipped, reducing scan accuracy and potentially missing findings — wireconfig-fileintoinit. - In
.github/workflows/codeql.yml, triggers are limited todevelopeven though the default branch ismain, which can leave key branches under-scanned and delay security feedback — align push/PR branch filters with the branches used by the repo’s other CI workflows.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/codeql.yml">
<violation number="1" location=".github/workflows/codeql.yml:16">
P2: This workflow is gated to trigger only on the `develop` branch for both push and pull_request, but the repository's default branch is `main` and the existing CI workflows run on `dev`, `develop`, `0.12.0-dev`, and `main` (see ci.yml). Because of that, code merged or opened as a PR against `main` — where releases happen — will bypass CodeQL scanning entirely. Consider widening the trigger branches to match the CI workflow (e.g. include `main`, `dev`, `0.12.0-dev`) so the default/release branch is covered too.</violation>
<violation number="2" location=".github/workflows/codeql.yml:64">
P2: This new workflow references third-party actions by mutable major-version tags (`actions/checkout@v7`, `github/codeql-action/init@v4`, `github/codeql-action/analyze@v4`), while every other workflow in this repository pins actions to full commit SHAs with a version comment (e.g. `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`). Floating tags are unverifiable and can be silently retargeted, which weakens the repo's supply-chain hardening. Consider pinning these three `uses` lines to the specific release SHAs (mirroring the convention used in ci.yml/docs.yml) to stay consistent and auditable.</violation>
<violation number="3" location=".github/workflows/codeql.yml:64">
P2: This workflow references actions/checkout@v7 and github/codeql-action/init@v4 / analyze@v4 by mutable version tags instead of pinning to a commit SHA, and does not set persist-credentials: false on checkout. This diverges from the pinned-SHA + persist-credentials:false hardening used elsewhere in the repo's workflows and increases supply-chain risk since tags can be moved to point at different code.</violation>
<violation number="4" location=".github/workflows/codeql.yml:77">
P2: The `init` step never passes `config-file`, so the repository's existing `.github/codeql-config.yml` is not applied by this workflow — its `security-and-quality` queries and `paths`/`paths-ignore` exclusions will be ignored, and analysis falls back to the default query set with default paths. Add `config-file: .github/codeql-config.yml` under `with:`.</violation>
</file>
Shadow auto-approve: would not auto-approve because issues were found.
Re-trigger cubic
|
|
||
| on: | ||
| push: | ||
| branches: [ "develop" ] |
There was a problem hiding this comment.
P2: This workflow is gated to trigger only on the develop branch for both push and pull_request, but the repository's default branch is main and the existing CI workflows run on dev, develop, 0.12.0-dev, and main (see ci.yml). Because of that, code merged or opened as a PR against main — where releases happen — will bypass CodeQL scanning entirely. Consider widening the trigger branches to match the CI workflow (e.g. include main, dev, 0.12.0-dev) so the default/release branch is covered too.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/codeql.yml, line 16:
<comment>This workflow is gated to trigger only on the `develop` branch for both push and pull_request, but the repository's default branch is `main` and the existing CI workflows run on `dev`, `develop`, `0.12.0-dev`, and `main` (see ci.yml). Because of that, code merged or opened as a PR against `main` — where releases happen — will bypass CodeQL scanning entirely. Consider widening the trigger branches to match the CI workflow (e.g. include `main`, `dev`, `0.12.0-dev`) so the default/release branch is covered too.</comment>
<file context>
@@ -0,0 +1,105 @@
+
+on:
+ push:
+ branches: [ "develop" ]
+ pull_request:
+ branches: [ "develop" ]
</file context>
| uses: github/codeql-action/init@v4 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| build-mode: ${{ matrix.build-mode }} |
There was a problem hiding this comment.
P2: The init step never passes config-file, so the repository's existing .github/codeql-config.yml is not applied by this workflow — its security-and-quality queries and paths/paths-ignore exclusions will be ignored, and analysis falls back to the default query set with default paths. Add config-file: .github/codeql-config.yml under with:.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/codeql.yml, line 77:
<comment>The `init` step never passes `config-file`, so the repository's existing `.github/codeql-config.yml` is not applied by this workflow — its `security-and-quality` queries and `paths`/`paths-ignore` exclusions will be ignored, and analysis falls back to the default query set with default paths. Add `config-file: .github/codeql-config.yml` under `with:`.</comment>
<file context>
@@ -0,0 +1,105 @@
+ uses: github/codeql-action/init@v4
+ with:
+ languages: ${{ matrix.language }}
+ build-mode: ${{ matrix.build-mode }}
+ # If you wish to specify custom queries, you can do so here or in a config file.
+ # By default, queries listed here will override any specified in a config file.
</file context>
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
P2: This workflow references actions/checkout@v7 and github/codeql-action/init@v4 / analyze@v4 by mutable version tags instead of pinning to a commit SHA, and does not set persist-credentials: false on checkout. This diverges from the pinned-SHA + persist-credentials:false hardening used elsewhere in the repo's workflows and increases supply-chain risk since tags can be moved to point at different code.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/codeql.yml, line 64:
<comment>This workflow references actions/checkout@v7 and github/codeql-action/init@v4 / analyze@v4 by mutable version tags instead of pinning to a commit SHA, and does not set persist-credentials: false on checkout. This diverges from the pinned-SHA + persist-credentials:false hardening used elsewhere in the repo's workflows and increases supply-chain risk since tags can be moved to point at different code.</comment>
<file context>
@@ -0,0 +1,105 @@
+ # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v7
+
+ # Add any setup steps before running the `github/codeql-action/init` action.
</file context>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
marlonsc
approved these changes
Aug 11, 2026
Contributor
|
Code review by qodo was updated up to the latest commit fcf9393 |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/codeql.yml (1)
64-77: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winLoad
.github/codeql-config.ymlin the CodeQL init step.The workflow does not load this tracked configuration. Add
config-file: ./.github/codeql-config.yml; otherwise its paths,security-and-qualityqueries, and Rust query filters have no effect. The workflow matrix still controls the analyzed languages, solanguages: ["rust"]does not override it. Ensure thesrc/cratespath scope is intentional for all four matrix jobs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml around lines 64 - 77, Update the “Initialize CodeQL” step using github/codeql-action/init to load the tracked configuration via the config-file setting pointing to ./.github/codeql-config.yml. Preserve the matrix.language value as the languages input and verify the configuration’s src/crates path scope applies intentionally across all four matrix jobs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 64: Update the github/codeql-action/init and github/codeql-action/analyze
references in the CodeQL workflow to verified full commit SHAs instead of the v4
tags, and update each adjacent release comment to match the pinned version.
---
Outside diff comments:
In @.github/workflows/codeql.yml:
- Around line 64-77: Update the “Initialize CodeQL” step using
github/codeql-action/init to load the tracked configuration via the config-file
setting pointing to ./.github/codeql-config.yml. Preserve the matrix.language
value as the languages input and verify the configuration’s src/crates path
scope applies intentionally across all four matrix jobs.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 9ecbc236-5291-4934-bb57-1d4a9dd6b581
📒 Files selected for processing (1)
.github/workflows/codeql.yml
📜 Review details
⏰ Context from checks skipped due to timeout. (7)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: cubic · AI code reviewer
- GitHub Check: ci
- GitHub Check: Analyze (actions)
- GitHub Check: Analyze (rust)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Analyze (python)
🔇 Additional comments (2)
.github/workflows/codeql.yml (2)
1-21: LGTM!Also applies to: 23-61
85-100: LGTM!
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
Pin the remaining CodeQL actions to full commit SHAs.
This change pins actions/checkout, but github/codeql-action/init@v4 and github/codeql-action/analyze@v4 remain tag-based. Pin both actions to verified commit SHAs and keep the release comments current.
#!/usr/bin/env bash
set -euo pipefail
for action in \
'github/codeql-action/init@v4' \
'github/codeql-action/analyze@v4'
do
repository="${action%@*}"
ref="${action#*@}"
gh api "repos/${repository}/commits/${ref}" \
--jq '"\(.sha) \(.commit.message | split("\n")[0])"'
done
rg -n 'uses: github/codeql-action/(init|analyze)@' .github/workflows/codeql.yml🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml at line 64, Update the
github/codeql-action/init and github/codeql-action/analyze references in the
CodeQL workflow to verified full commit SHAs instead of the v4 tags, and update
each adjacent release comment to match the pinned version.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by cubic
Adds a CodeQL Advanced workflow to scan Actions, JS/TS, Python, and Rust on pushes and PRs to
develop, plus a weekly run. Pinsactions/checkout@v7.0.1and sets explicit permissions to support private packs..github/workflows/codeql.ymlwith a language matrix (actions, javascript-typescript, python, rust) using build-modenone.developand a weekly cron (20 8 * * 6).github/codeql-action@v4, runs onubuntu-latest(ormacos-latestforswift), pinsactions/checkout@v7.0.1, and setssecurity-events: write,packages: read,actions: read,contents: read.Written for commit fcf9393. Summary will update on new commits.