feat: codeql workflow for ts and rust by shankars99 · Pull Request #1864 · LayerZero-Labs/devtools

shankars99 · 2025-12-08T06:56:20Z

CodeQL extension does not run on fork prs into devtools. This workflow yaml should effectively replace the extension.

Also took the liberty to add in:

Dockerfile scanning
Shell script scanning

ontop of codeql's js-ts and rust

It also runs weekly scans on main

github-actions · 2025-12-08T07:01:43Z

🚨 E2E Tests Failed

The E2E tests failed during CI. These tests validate real blockchain interactions and may fail due to:

Network connectivity issues
RPC rate limiting
External service downtime
Action Run: https://github.com/LayerZero-Labs/devtools/actions/runs/20019444246

This is non-blocking and does not prevent merging. Check the action logs above for detailed failure information.

socket-security · 2025-12-08T07:07:42Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
	github/hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf

View full report

github-actions · 2025-12-08T07:08:48Z

🚨 E2E Tests Failed

The E2E tests failed during CI. These tests validate real blockchain interactions and may fail due to:

Network connectivity issues
RPC rate limiting
External service downtime
Action Run: https://github.com/LayerZero-Labs/devtools/actions/runs/20019641588

This is non-blocking and does not prevent merging. Check the action logs above for detailed failure information.

github-advanced-security · 2025-12-08T07:10:01Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

Copilot

Pull request overview

This PR implements a comprehensive security scanning workflow to replace the GitHub CodeQL extension, which doesn't support fork PRs. The workflow adds CodeQL analysis for TypeScript/JavaScript and Rust, plus additional security scanning for Dockerfiles and shell scripts, with weekly automated scans on the main branch.

Key Changes:

CodeQL security analysis for JavaScript/TypeScript and Rust with extended security queries
Hadolint scanning for Dockerfile security and best practices
ShellCheck integration for shell script linting

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2025-12-08T07:28:18Z

🚨 E2E Tests Failed

The E2E tests failed during CI. These tests validate real blockchain interactions and may fail due to:

Network connectivity issues
RPC rate limiting
External service downtime
Action Run: https://github.com/LayerZero-Labs/devtools/actions/runs/20020063122

This is non-blocking and does not prevent merging. Check the action logs above for detailed failure information.

ravinagill15

Looks good, just minor comments / clarifications

github-actions · 2025-12-08T17:57:37Z

🚨 E2E Tests Failed

The E2E tests failed during CI. These tests validate real blockchain interactions and may fail due to:

Network connectivity issues
RPC rate limiting
External service downtime
Action Run: https://github.com/LayerZero-Labs/devtools/actions/runs/20037619201

This is non-blocking and does not prevent merging. Check the action logs above for detailed failure information.

St0rmBr3w

LGTM!

github-actions · 2025-12-08T18:40:17Z

🚨 E2E Tests Failed

The E2E tests failed during CI. These tests validate real blockchain interactions and may fail due to:

Network connectivity issues
RPC rate limiting
External service downtime
Action Run: https://github.com/LayerZero-Labs/devtools/actions/runs/20038840901

This is non-blocking and does not prevent merging. Check the action logs above for detailed failure information.

github-actions · 2025-12-08T18:51:30Z

🚨 E2E Tests Failed

The E2E tests failed during CI. These tests validate real blockchain interactions and may fail due to:

Network connectivity issues
RPC rate limiting
External service downtime
Action Run: https://github.com/LayerZero-Labs/devtools/actions/runs/20039132088

This is non-blocking and does not prevent merging. Check the action logs above for detailed failure information.

github-actions · 2025-12-08T19:06:50Z

🚨 E2E Tests Failed

The E2E tests failed during CI. These tests validate real blockchain interactions and may fail due to:

Network connectivity issues
RPC rate limiting
External service downtime
Action Run: https://github.com/LayerZero-Labs/devtools/actions/runs/20039506206

This is non-blocking and does not prevent merging. Check the action logs above for detailed failure information.

Signed-off-by: shankar <shankar@layerzerolabs.org>

github-actions · 2025-12-10T01:37:41Z

🚨 E2E Tests Failed

The E2E tests failed during CI. These tests validate real blockchain interactions and may fail due to:

Network connectivity issues
RPC rate limiting
External service downtime
Action Run: https://github.com/LayerZero-Labs/devtools/actions/runs/20084239642

This is non-blocking and does not prevent merging. Check the action logs above for detailed failure information.

St0rmBr3w

lgtm

tinom9 · 2025-12-10T01:47:28Z

+
+# Cancel in-progress runs when a new commit is pushed
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}


I think this will only cancel in-progress runs in a same PR.

I'm guessing it's ok.

yeah thats what we wanna do

shankars99 marked this pull request as ready for review December 8, 2025 07:14

shankars99 requested a review from Copilot December 8, 2025 07:16

Copilot AI reviewed Dec 8, 2025

View reviewed changes

Comment thread .github/workflows/codeql.yaml Outdated

Comment thread .github/workflows/codeql.yaml Outdated

ravinagill15 previously approved these changes Dec 8, 2025

View reviewed changes

Comment thread .github/workflows/codeql.yaml Outdated

Comment thread .github/workflows/codeql.yml

shankars99 dismissed ravinagill15’s stale review via c360e76 December 8, 2025 17:53

St0rmBr3w previously approved these changes Dec 8, 2025

View reviewed changes

shankars99 dismissed St0rmBr3w’s stale review via 3a46b0f December 8, 2025 18:37

shankars99 force-pushed the ci/codeql-workflow branch from 3a46b0f to 0312338 Compare December 8, 2025 18:46

ravinagill15 previously approved these changes Dec 8, 2025

View reviewed changes

shankars99 dismissed ravinagill15’s stale review via a81c644 December 8, 2025 19:02

shankars99 added 7 commits December 10, 2025 01:31

feat: codeql workflow for ts and rust

684e496

Signed-off-by: shankar <shankar@layerzerolabs.org>

chore: add dockerfile and shellscript

fdffe68

Signed-off-by: shankar <shankar@layerzerolabs.org>

version tagging actions

75b4077

Signed-off-by: shankar <shankar@layerzerolabs.org>

chore: remove redundant permissions

79cf1e0

Signed-off-by: shankar <shankar@layerzerolabs.org>

chore: create a CodeQL workflow to match the required status check

b4f1054

Signed-off-by: shankar <shankar@layerzerolabs.org>

rename to match what codeql expect

08bf4b6

Signed-off-by: shankar <shankar@layerzerolabs.org>

workflow name codeql

d48ad27

Signed-off-by: shankar <shankar@layerzerolabs.org>

shankars99 force-pushed the ci/codeql-workflow branch from a81c644 to d48ad27 Compare December 10, 2025 01:31

St0rmBr3w approved these changes Dec 10, 2025

View reviewed changes

shankars99 enabled auto-merge December 10, 2025 01:40

tinom9 approved these changes Dec 10, 2025

View reviewed changes

shankars99 added this pull request to the merge queue Dec 10, 2025

Merged via the queue into main with commit 7303538 Dec 10, 2025
18 checks passed

shankars99 deleted the ci/codeql-workflow branch December 10, 2025 02:08

shankars99 mentioned this pull request Dec 10, 2025

update codeql workflow #1872

Merged

shankars99 self-assigned this Dec 17, 2025

shankars99 added the ready to review in a state where CI passes and the PR is quite upto date with main and you need reviews label Dec 17, 2025

Uh oh!

Conversation

shankars99 commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Dec 8, 2025

🚨 E2E Tests Failed

Uh oh!

socket-security Bot commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Dec 8, 2025

🚨 E2E Tests Failed

Uh oh!

github-advanced-security AI commented Dec 8, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Dec 8, 2025

🚨 E2E Tests Failed

Uh oh!

ravinagill15 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Dec 8, 2025

🚨 E2E Tests Failed

Uh oh!

St0rmBr3w left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Dec 8, 2025

🚨 E2E Tests Failed

Uh oh!

github-actions Bot commented Dec 8, 2025

🚨 E2E Tests Failed

Uh oh!

github-actions Bot commented Dec 8, 2025

🚨 E2E Tests Failed

Uh oh!

github-actions Bot commented Dec 10, 2025

🚨 E2E Tests Failed

Uh oh!

St0rmBr3w left a comment

Choose a reason for hiding this comment

Uh oh!

tinom9 Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

shankars99 Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

shankars99 commented Dec 8, 2025 •

edited

Loading

socket-security Bot commented Dec 8, 2025 •

edited

Loading