Add codeql workflow - #1685
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that runs CodeQL for Go on ChangesCodeQL analysis workflow
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 44-45: Update the actions/checkout step in the CodeQL workflow to
set persist-credentials to false. Keep the existing checkout action version and
workflow behavior unchanged, ensuring repository-controlled make commands cannot
access a persisted authentication token.
- Around line 26-34: Update the CodeQL job’s permissions block under analyze to
explicitly include contents: read and actions: read alongside the existing
security-events: write and packages: read permissions, preserving repository
checkout access.
- Around line 52-53: Update both the github/codeql-action references in the
CodeQL workflow, including Initialize CodeQL and the corresponding analyze step,
to pin version v4.37.3 to SHA e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5d6d5639-fc91-40b5-b1e3-aca81146cc9a
📒 Files selected for processing (1)
.github/workflows/codeql.yml
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/codeql.yml (1)
45-46:⚠️ Potential issue | 🟠 MajorDisable checkout credential persistence.
actions/checkoutpersistsGITHUB_TOKENby default, and the subsequent repository-controlledmakecommands can access it. No later step requires authenticated Git operations, so setpersist-credentials: false.Proposed fix
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml around lines 45 - 46, Update the actions/checkout step in the CodeQL workflow to set persist-credentials to false, ensuring subsequent repository-controlled make commands cannot access the persisted GITHUB_TOKEN.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 26-35: Update the job-level permissions block for the analyze job
to include contents: read and actions: read alongside the existing
security-events: write and packages: read permissions, preserving the required
CodeQL access.
---
Duplicate comments:
In @.github/workflows/codeql.yml:
- Around line 45-46: Update the actions/checkout step in the CodeQL workflow to
set persist-credentials to false, ensuring subsequent repository-controlled make
commands cannot access the persisted GITHUB_TOKEN.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5c5c355a-6a0a-4c44-a460-c185b533e997
📒 Files selected for processing (1)
.github/workflows/codeql.yml
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze (${{ matrix.language }}) | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| security-events: write | ||
| packages: read |
There was a problem hiding this comment.
Restore the CodeQL job’s repository read permissions.
The job-level permissions block overrides the top-level block, so contents: read is currently lost. This can prevent actions/checkout and CodeQL from reading the repository. Add contents: read and actions: read to the job permissions.
Proposed fix
permissions:
+ actions: read
+ contents: read
security-events: write
packages: read🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 26 - 35, Update the job-level
permissions block for the analyze job to include contents: read and actions:
read alongside the existing security-events: write and packages: read
permissions, preserving the required CodeQL access.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dkwon17, rohanKanojia The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Hi! I'm che-ai-assistant — I help with your pull requests. I check for new comments every 10m0s, so there may be a short delay before I respond. Available commands:
|
|
New changes are detected. LGTM label has been removed. |
|
/retest |
1 similar comment
|
/retest |
Signed-off-by: David Kwon <dakwon@redhat.com>
Signed-off-by: David Kwon <dakwon@redhat.com>
Signed-off-by: David Kwon <dakwon@redhat.com>
Signed-off-by: David Kwon <dakwon@redhat.com>
Signed-off-by: dkwon17 <dakwon@redhat.com>
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
4 participants
What does this PR do?
Adds CodeQL PR check and weekly scan on Monday morning (7:15 UTC).
What issues does this PR fix or reference?
Part of https://github.com/ambient-code/agentready suggestions.
Is it tested? How?
PR Checklist
/test v8-devworkspace-operator-e2e, v8-che-happy-pathto trigger)v8-devworkspace-operator-e2e: DevWorkspace e2e testv8-che-happy-path: Happy path for verification integration with CheSummary by CodeRabbit