fix: address CodeQL security and code quality issues#572
Merged
JasonXuDeveloper merged 4 commits intomasterfrom Jan 25, 2026
Merged
fix: address CodeQL security and code quality issues#572JasonXuDeveloper merged 4 commits intomasterfrom
JasonXuDeveloper merged 4 commits intomasterfrom
Conversation
- Add explicit permissions to workflows (dco-check, pr-tests, release, unity-tests) - Fix useless casts in Bootstrap.cs using GetAssetObject<T>() - Fix useless cast in SettingsUIBuilder.cs using pattern matching - Convert if-else to ternary in BuildManager.cs - Use StringBuilder instead of string concatenation in loop (EditorUIUtils.cs) - Remove trailing slash in Path.Combine (EncryptConfig.cs) - Fix static field written by instance method (Bootstrap.cs) Remaining issues are intentional: - Generic catch clauses: kept for crash prevention in game framework - Nested if-statements: code style preference - Complex block: existing algorithm structure Signed-off-by: JasonXuDeveloper - 傑 <jason@xgamedev.net>
Exclude rules that represent intentional design decisions: - cs/catch-of-all-exceptions: crash prevention in game framework - cs/nested-if-statements: acceptable code style - cs/complex-block: algorithm implementations - cs/linq/missed-where: LINQ avoided for performance Signed-off-by: JasonXuDeveloper - 傑 <jason@xgamedev.net>
Unity Test Results❌ EditMode: Tests failed Unity Version: 2022.3.55f1 ❌ Some tests failed. Please fix the failing tests before merging. View workflow run |
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
v3 will be deprecated in December 2026 Signed-off-by: JasonXuDeveloper - 傑 <jason@xgamedev.net>
The game-ci/unity-test-runner action needs checks:write permission to create check runs via the checkName parameter. Signed-off-by: JasonXuDeveloper - 傑 <jason@xgamedev.net> Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
JasonXuDeveloper
force-pushed
the
fix/codeql-security-issues
branch
from
cfe3a81 to
63b85ff
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses CodeQL security and code quality issues from code scanning.
Fixed Issues (17 of 55)
actions/missing-workflow-permissionspermissionsblockscs/useless-cast-to-selfGetAssetObject<T>()and pattern matchingcs/missed-ternary-operatorcs/string-concatenation-in-loopStringBuildercs/path-combinecs/static-field-written-by-instanceExcluded from Future Scans (32 alerts)
Updated
.github/codeql/codeql-config.ymlto exclude intentional patterns:cs/catch-of-all-exceptionscs/nested-if-statementscs/complex-blockcs/linq/missed-whereRemaining (6 alerts)
cs/dispose-not-called-on-throwChanges by File
CodeQL Config:
codeql-config.yml- Addedquery-filtersto exclude intentional patternsWorkflows:
dco-check.yml- Addedcontents: readpr-tests.yml- Addedcontents: read,pull-requests: write,statuses: writerelease.yml- Addedcontents: writeunity-tests.yml- Addedcontents: readRuntime Code:
Bootstrap.cs- UseGetAssetObject<T>()instead of casts, add static setterEncryptConfig.cs- Remove trailing slash from pathCryptoUtils.cs- Added doc comment explaining foreach preference over LINQEditor Code:
BuildManager.cs- Convert if-else to ternaryEditorUIUtils.cs- Use StringBuilder for loop concatenationSettingsUIBuilder.cs- Use pattern matching instead of castTest plan
🤖 Generated with Claude Code