ci(codeql): add CodeQL analysis workflow for this repository#162
Open
ci(codeql): add CodeQL analysis workflow for this repository#162
Conversation
WalkthroughA new GitHub Actions workflow file was introduced to enable CodeQL security analysis. The workflow executes on push/pull request events to Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
github-actions
bot
added
workflow
🔍 Lint Analysis
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/self-codeql.yml:
- Around line 22-45: Replace the embedded CodeQL job logic in self-codeql.yml
(the "analyze" job with its runs-on, strategy/matrix and step list including
"Perform CodeQL Analysis") with a single delegation to the repository's reusable
CodeQL workflow: remove the job-level business logic (runs-on, matrix, and
steps) and instead add a job that calls the reusable workflow using uses: with
required inputs/parameters (e.g., language/category) so this self-* entrypoint
only invokes the reusable workflow and does not contain analysis steps itself.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: b5d4914c-c979-4674-84ef-a40df3216660
📒 Files selected for processing (1)
.github/workflows/self-codeql.yml
Comment on lines
+22
to
+45
| jobs: | ||
| analyze: | ||
| name: CodeQL Analysis | ||
| runs-on: blacksmith-4vcpu-ubuntu-2404 | ||
|
|
||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| language: | ||
| - actions | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v4 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v4 | ||
| with: | ||
| category: '/language:${{ matrix.language }}' |
There was a problem hiding this comment.
Self entrypoint should delegate to a reusable workflow instead of embedding CodeQL job logic.
This self-codeql.yml implements the full analysis job directly (runs-on, matrix, steps). For this repository’s self-* workflows, the entrypoint should only call a corresponding reusable workflow via local path and avoid business logic in the self file.
Suggested refactor direction
jobs:
analyze:
- name: CodeQL Analysis
- runs-on: blacksmith-4vcpu-ubuntu-2404
- strategy:
- fail-fast: false
- matrix:
- language:
- - actions
- steps:
- - name: Checkout repository
- uses: actions/checkout@v6
- - name: Initialize CodeQL
- uses: github/codeql-action/init@v4
- with:
- languages: ${{ matrix.language }}
- - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v4
- with:
- category: '/language:${{ matrix.language }}'
+ uses: ./.github/workflows/codeql.yml
+ # pass inputs/secrets here once reusable workflow existsAs per coding guidelines: ".github/workflows/self-*.yml ... Must call the corresponding reusable workflow via local path and contain no business logic."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/self-codeql.yml around lines 22 - 45, Replace the embedded
CodeQL job logic in self-codeql.yml (the "analyze" job with its runs-on,
strategy/matrix and step list including "Perform CodeQL Analysis") with a single
delegation to the repository's reusable CodeQL workflow: remove the job-level
business logic (runs-on, matrix, and steps) and instead add a job that calls the
reusable workflow using uses: with required inputs/parameters (e.g.,
language/category) so this self-* entrypoint only invokes the reusable workflow
and does not contain analysis steps itself.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions Shared Workflows
Description
Adds a CodeQL analysis self workflow (
self-codeql.yml) to scan this repository's GitHub Actions workflows and composite actions for security issues such as script injection, untrusted input usage, and other common Actions vulnerabilities.actions(GitHub Actions-specific analysis)developandmain, weekly schedule (Monday 06:00 UTC), and manual dispatchType of Change
feat: New workflow or new input/output/step in an existing workflowfix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)perf: Performance improvement (e.g. caching, parallelism, reduced steps)refactor: Internal restructuring with no behavior changedocs: Documentation only (README, docs/, inline comments)ci: Changes to self-CI (workflows under.github/workflows/that run on this repo)chore: Dependency bumps, config updates, maintenancetest: Adding or updating testsBREAKING CHANGE: Callers must update their configuration after this PRBreaking Changes
None.
Testing
@developor the beta tagCaller repo / workflow run: N/A — self-CI workflow, will run on this PR once merged.
Related Issues
N/A
Summary by CodeRabbit