From 192405c90fbd2a4f7c0dd15984a190b5cb7f0cc0 Mon Sep 17 00:00:00 2001 From: shankar Date: Mon, 8 Dec 2025 06:55:16 +0000 Subject: [PATCH 1/7] feat: codeql workflow for ts and rust Signed-off-by: shankar --- .github/workflows/codeql.yaml | 76 +++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+) create mode 100644 .github/workflows/codeql.yaml diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml new file mode 100644 index 0000000000..40eb556697 --- /dev/null +++ b/.github/workflows/codeql.yaml @@ -0,0 +1,76 @@ +# .-.-. .-.-. .-.-. .-.-. .-.-. .-.-. .-.-. .-.- .-.-. .-.-. .-.- +# / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ / / \ \ / / \ \ / / \ +# `-' `-`-' `-`-' `-`-' `-`-' `-`-' `-`-' `-' `-`-' `-`-' `-`-' +# +# CodeQL Security Analysis +# +# This workflow replaces the GitHub CodeQL extension to support fork PRs. +# The extension doesn't trigger on fork PRs due to security restrictions. +# This workflow uses the pull_request event which works for all PRs. +# +# .-.-. .-.-. .-.-. .-.-. .-.-. .-.-. .-.-. .-.- .-.-. .-.-. .-.- +# / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ / / \ \ / / \ \ / / \ +# `-' `-`-' `-`-' `-`-' `-`-' `-`-' `-`-' `-`-' `-' `-`-' `-`-' +name: CodeQL Security Analysis + +on: + push: + branches: + - main + - develop + pull_request: + branches: + - main + - develop + schedule: + # Run weekly security scans every Monday at midnight UTC + - cron: '0 0 * * 1' + +# Cancel in-progress runs when a new commit is pushed +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +# Minimal permissions for fork PRs +# Results are uploaded to Security tab and posted as checks +permissions: + contents: read + security-events: write + actions: read + +jobs: + analyze: + name: CodeQL Analysis + runs-on: ubuntu-latest + timeout-minutes: 15 + + permissions: + contents: read + security-events: write + actions: read + + strategy: + fail-fast: false + matrix: + language: ['javascript-typescript', 'rust'] + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: 'true' + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + # Use default queries plus security-extended for more coverage + queries: security-extended + + # Skip autobuild - CodeQL can analyze source code directly + # No need to compile or install dependencies for static analysis + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{ matrix.language }}" From 66ac92be1e392e7febf30369fbee0928a5625abc Mon Sep 17 00:00:00 2001 From: shankar Date: Mon, 8 Dec 2025 07:05:21 +0000 Subject: [PATCH 2/7] chore: add dockerfile and shellscript Signed-off-by: shankar --- .github/workflows/codeql.yaml | 64 +++++++++++++++++++++++++++++++++-- 1 file changed, 62 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 40eb556697..433f0a1f8a 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -22,6 +22,11 @@ on: branches: - main - develop + merge_group: + # Required for GitHub merge queue + branches: + - main + - develop schedule: # Run weekly security scans every Monday at midnight UTC - cron: '0 0 * * 1' @@ -61,9 +66,10 @@ jobs: submodules: 'true' - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} + build-mode: none # Use default queries plus security-extended for more coverage queries: security-extended @@ -71,6 +77,60 @@ jobs: # No need to compile or install dependencies for static analysis - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 with: category: "/language:${{ matrix.language }}" + + dockerfile: + name: Dockerfile Lint + runs-on: ubuntu-latest + timeout-minutes: 5 + needs: analyze + + permissions: + contents: read + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Run Hadolint + uses: hadolint/hadolint-action@v3.1.0 + with: + dockerfile: Dockerfile + format: sarif + output-file: hadolint.sarif + no-fail: true + + - name: Upload Hadolint results + uses: github/codeql-action/upload-sarif@v3 + if: always() + with: + sarif_file: hadolint.sarif + category: "hadolint" + + shellcheck: + name: Shell Script Lint + runs-on: ubuntu-latest + timeout-minutes: 5 + needs: analyze + + permissions: + contents: read + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Run ShellCheck + uses: ludeeus/action-shellcheck@master + with: + scandir: '.' + format: gcc + severity: warning + continue-on-error: true + + # Note: ShellCheck action doesn't natively support SARIF output + # Results will appear in workflow logs From 30fb02877dfc3c0221f607e2ae66765c2c794db1 Mon Sep 17 00:00:00 2001 From: shankar Date: Mon, 8 Dec 2025 07:22:48 +0000 Subject: [PATCH 3/7] version tagging actions Signed-off-by: shankar --- .github/workflows/codeql.yaml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 433f0a1f8a..e9d35202ff 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -59,6 +59,8 @@ jobs: matrix: language: ['javascript-typescript', 'rust'] + # Skip autobuild - CodeQL can analyze source code directly + # No need to compile or install dependencies for static analysis steps: - name: Checkout repository uses: actions/checkout@v4 @@ -73,9 +75,6 @@ jobs: # Use default queries plus security-extended for more coverage queries: security-extended - # Skip autobuild - CodeQL can analyze source code directly - # No need to compile or install dependencies for static analysis - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v4 with: @@ -104,12 +103,14 @@ jobs: no-fail: true - name: Upload Hadolint results - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 if: always() with: sarif_file: hadolint.sarif category: "hadolint" +# Note: ShellCheck action doesn't natively support SARIF output +# Results will appear in workflow logs shellcheck: name: Shell Script Lint runs-on: ubuntu-latest @@ -125,12 +126,10 @@ jobs: uses: actions/checkout@v4 - name: Run ShellCheck - uses: ludeeus/action-shellcheck@master + uses: ludeeus/action-shellcheck@2.0.0 with: scandir: '.' format: gcc severity: warning continue-on-error: true - # Note: ShellCheck action doesn't natively support SARIF output - # Results will appear in workflow logs From c360e764981090251a5ded30bf78716c070a89c1 Mon Sep 17 00:00:00 2001 From: shankar Date: Mon, 8 Dec 2025 17:53:07 +0000 Subject: [PATCH 4/7] chore: remove redundant permissions Signed-off-by: shankar --- .github/workflows/codeql.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index e9d35202ff..ac5efc3b18 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -49,11 +49,6 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 - permissions: - contents: read - security-events: write - actions: read - strategy: fail-fast: false matrix: From 0312338aa336cef9d30e34c55bb7a82274002d8c Mon Sep 17 00:00:00 2001 From: shankar Date: Mon, 8 Dec 2025 18:46:06 +0000 Subject: [PATCH 5/7] chore: create a CodeQL workflow to match the required status check Signed-off-by: shankar --- .github/workflows/codeql.yaml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index ac5efc3b18..8840485008 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -128,3 +128,27 @@ jobs: severity: warning continue-on-error: true + # Final status check job for backwards compatibility with the old CodeQL workflow + CodeQL: + name: CodeQL + runs-on: ubuntu-latest + needs: [analyze, dockerfile, shellcheck] + if: always() + + steps: + - name: Check all jobs succeeded + run: | + if [ "${{ needs.analyze.result }}" != "success" ]; then + echo "CodeQL analysis failed" + exit 1 + fi + if [ "${{ needs.dockerfile.result }}" != "success" ]; then + echo "Dockerfile lint failed" + exit 1 + fi + if [ "${{ needs.shellcheck.result }}" != "success" ]; then + echo "ShellCheck lint failed" + exit 1 + fi + echo "All security checks passed!" + From 8a98ff2d86e8974c70b91c5eedf5d816d79c1fcf Mon Sep 17 00:00:00 2001 From: shankar Date: Mon, 8 Dec 2025 18:47:58 +0000 Subject: [PATCH 6/7] rename to match what codeql expect Signed-off-by: shankar --- .github/workflows/{codeql.yaml => codeql.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{codeql.yaml => codeql.yml} (100%) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yml similarity index 100% rename from .github/workflows/codeql.yaml rename to .github/workflows/codeql.yml From a81c644aeb1f1bdb6450f911159beddb6daf0c8e Mon Sep 17 00:00:00 2001 From: shankar Date: Mon, 8 Dec 2025 19:02:12 +0000 Subject: [PATCH 7/7] workflow name codeql Signed-off-by: shankar --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8840485008..e8bcb4b487 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,7 +2,7 @@ # / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ / / \ \ / / \ \ / / \ # `-' `-`-' `-`-' `-`-' `-`-' `-`-' `-`-' `-' `-`-' `-`-' `-`-' # -# CodeQL Security Analysis +# CodeQL # # This workflow replaces the GitHub CodeQL extension to support fork PRs. # The extension doesn't trigger on fork PRs due to security restrictions. @@ -11,7 +11,7 @@ # .-.-. .-.-. .-.-. .-.-. .-.-. .-.-. .-.-. .-.- .-.-. .-.-. .-.- # / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ / / \ \ / / \ \ / / \ # `-' `-`-' `-`-' `-`-' `-`-' `-`-' `-`-' `-`-' `-' `-`-' `-`-' -name: CodeQL Security Analysis +name: CodeQL on: push: