feat: added codeQL support for security in the CI#70
feat: added codeQL support for security in the CI#70Achintya-Chatterjee wants to merge 1 commit intodevelopfrom
Conversation
Summary by CodeRabbit
WalkthroughA new GitHub Actions workflow file named "CodeQL Advanced" has been added. This workflow automates security and quality analysis using CodeQL for multiple programming languages. It is configured to run on pushes and pull requests to the "develop" branch, as well as on a weekly schedule, and includes setup, initialization, and analysis steps. Changes
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
Achintya-Chatterjee
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/codeql.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/codeql.yml
[warning] 14-14: truthy value should be one of [false, true]
(truthy)
[error] 16-16: too many spaces inside brackets
(brackets)
[error] 16-16: too many spaces inside brackets
(brackets)
[error] 18-18: too many spaces inside brackets
(brackets)
[error] 18-18: too many spaces inside brackets
(brackets)
[error] 46-46: wrong indentation: expected 10 but found 8
(indentation)
[warning] 50-50: comment not indented like content
(comments-indentation)
[error] 59-59: wrong indentation: expected 6 but found 4
(indentation)
🔇 Additional comments (4)
.github/workflows/codeql.yml (4)
1-11: File Header Comments
The descriptive comments are helpful for onboarding and guiding future customization; no changes needed here.
31-41: Permission Scope
Thepermissionsblock adheres to GitHub’s least-privilege principle by granting only the required scopes for CodeQL. Well done.
87-95: Manual Build Fallback
The conditional manual-build instructions and failure exit are clear and enforce explicit build steps. No changes needed here.
14-20:Details
❓ Verification inconclusive
Refine Trigger Configuration and Formatting
Currently it only fires on pushes and PRs todevelop. Verify whether you also want scans onmainor release branches. Additionally, YAML lint flags extra spaces in the branch arrays ([ "develop" ]). For cleaner syntax and to satisfy linting, update to:- branches: [ "develop" ] + branches: ["develop"]
Refine CodeQL Workflow Triggers and Formatting
The CodeQL scan is currently limited to pushes and PRs ondevelop. Confirm whether you also want to includemainor other release branches to ensure production code is scanned. Additionally, most YAML linters flag the extra spaces inside array brackets—update both sections as follows:File: .github/workflows/codeql.yml (lines 14–20)
- branches: [ "develop" ] + branches: ["develop"]🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 14-14: truthy value should be one of [false, true]
(truthy)
[error] 16-16: too many spaces inside brackets
(brackets)
[error] 16-16: too many spaces inside brackets
(brackets)
[error] 18-18: too many spaces inside brackets
(brackets)
[error] 18-18: too many spaces inside brackets
(brackets)
| # the `language` matrix defined below to confirm you have the correct set of | ||
| # supported CodeQL languages. | ||
| # | ||
| name: "CodeQL Advanced" |
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Workflow Name Clarity
The workflow name "CodeQL Advanced" is clear. Consider aligning it with your existing naming conventions or removing the quotes for consistency.
🤖 Prompt for AI Agents
In .github/workflows/codeql.yml at line 12, the workflow name is set as "CodeQL
Advanced" with quotes. To maintain consistency with existing naming conventions,
remove the quotes around the workflow name or adjust it to match the style used
in other workflow files.
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v3 | ||
| with: | ||
| category: "/language:${{matrix.language}}" |
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Perform CodeQL Analysis
The analyze action is hooked up properly. Optionally, you could specify SARIF or upload settings if you need custom formatting or external integrations; otherwise, this looks good.
🤖 Prompt for AI Agents
In .github/workflows/codeql.yml around lines 97 to 100, the CodeQL analyze
action is correctly configured but lacks optional parameters for SARIF output or
upload settings. To enhance customization or integration, add parameters to
specify SARIF output file paths or upload options as needed. If no custom
formatting or external integration is required, no changes are necessary.
| runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} | ||
| permissions: |
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Simplify runs-on Setup
The inline conditional expression works, but you could move the OS configuration into the matrix for better readability and easier expansion:
matrix:
include:
- language: swift
os: macos-latest
build-mode: none
- language: python
os: ubuntu-latest
build-mode: none
runs-on: ${{ matrix.os }}🤖 Prompt for AI Agents
In .github/workflows/codeql.yml around lines 30 to 31, the runs-on field uses an
inline conditional expression to select the OS based on the language, which
reduces readability and flexibility. Refactor by moving the OS configuration
into the matrix definition, adding an os key for each language entry, and then
update runs-on to simply use ${{ matrix.os }}. This change improves clarity and
makes it easier to add more languages or OS options in the future.
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| build-mode: ${{ matrix.build-mode }} | ||
| # If you wish to specify custom queries, you can do so here or in a config file. | ||
| # By default, queries listed here will override any specified in a config file. | ||
| # Prefix the list here with "+" to use these queries and those in the config file. | ||
|
|
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Initialize CodeQL Configuration
The init step correctly drives languages and build modes via the matrix. To speed up subsequent runs, consider enabling caching:
- uses: github/codeql-action/init@v3
+ uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
+ cache: true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| # If you wish to specify custom queries, you can do so here or in a config file. | |
| # By default, queries listed here will override any specified in a config file. | |
| # Prefix the list here with "+" to use these queries and those in the config file. | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| cache: true | |
| # If you wish to specify custom queries, you can do so here or in a config file. | |
| # By default, queries listed here will override any specified in a config file. | |
| # Prefix the list here with "+" to use these queries and those in the config file. |
🤖 Prompt for AI Agents
In .github/workflows/codeql.yml around lines 69 to 77, the CodeQL init step
lacks caching configuration which can speed up subsequent runs. Add a cache
option under the init step by specifying cache: true to enable caching of CodeQL
databases between workflow runs, improving performance.
| matrix: | ||
| include: | ||
| - language: actions | ||
| build-mode: none | ||
| - language: python | ||
| build-mode: none |
There was a problem hiding this comment.
Matrix include Indentation & Language Coverage
YAML lint reports the - language: entries are under-indented (expected 10 spaces, found 8), which will break the YAML. Also, double-check that all intended languages are listed. For example:
- - language: actions
- build-mode: none
+ - language: actions
+ build-mode: noneCommittable suggestion skipped: line range outside the PR's diff.
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 46-46: wrong indentation: expected 10 but found 8
(indentation)
🤖 Prompt for AI Agents
In .github/workflows/codeql.yml around lines 44 to 49, the entries under matrix
include are under-indented by 2 spaces, causing YAML lint errors. Adjust the
indentation of the - language: lines and their nested build-mode lines to be 10
spaces from the left margin as expected. Also, review the matrix to ensure all
required languages for the workflow are included.
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
There was a problem hiding this comment.
Fix Steps Indentation
The steps: block and its first step are misaligned. Adjust the indent so the dash is nested under steps: (two spaces in from the block key):
- steps:
- - name: Checkout repository
+ steps:
+ - name: Checkout repositoryThis is critical to ensure the workflow parses correctly.
Committable suggestion skipped: line range outside the PR's diff.
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 59-59: wrong indentation: expected 6 but found 4
(indentation)
🤖 Prompt for AI Agents
In .github/workflows/codeql.yml around lines 58 to 61, the indentation of the
steps block and its first step is incorrect. Fix this by indenting the dash of
the first step two spaces under the steps key, ensuring proper YAML nesting and
correct workflow parsing.
2 participants
Date:
June 3, 2025Developer Name: @Achintya-Chatterjee
Issue Ticket Number
Description
Documentation Updated?
Under Feature Flag
Database Changes
Breaking Changes
Development Tested?
Screenshots
Screenshot 1
Test Coverage
Screenshot 1
Additional Notes