ci: add CodeQL workflow for Go (SAST)#2851
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
github-actions
Bot
added
size/M
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds a new GitHub Actions CodeQL workflow that runs on pushes and pull requests to main and weekly, configures workflow-level read permissions, job-level security-events write permission, concurrency cancellation, a Go CodeQL matrix, and pinned CodeQL action SHAs. Also updates the scorecard workflow to use CodeQL action v4.36.2. ChangesCodeQL and Security Scanning Workflows
Sequence DiagramsequenceDiagram
participant GitHub as GitHub (event)
participant Runner as Actions Runner
participant Checkout as actions/checkout
participant SetupGo as actions/setup-go
participant CodeQLInit as codeql-action/init
participant CodeQLAnalyze as codeql-action/analyze
GitHub->>Runner: trigger workflow (push/PR/cron)
Runner->>Checkout: checkout repository (persist-credentials: false)
Runner->>SetupGo: setup Go from go.mod
Runner->>CodeQLInit: init CodeQL (Go, autobuild)
Runner->>CodeQLAnalyze: run CodeQL analysis
CodeQLAnalyze->>GitHub: upload security events
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Raise the OpenSSF Scorecard SAST check (was 0/10) by adding GitHub's recommended CodeQL analysis for Go. Runs on push and PR to main plus a weekly schedule, and uploads results to the code-scanning dashboard. - build-mode: none extracts Go source without compiling, so the job cannot fail on the monorepo's generated files, build tags, or the api/apps/v1alpha1 submodule. It still produces real alerts and is credited by Scorecard. Can be switched to autobuild later for deeper build-aware analysis. - Top-level token is read-only; the analyze job opts into security-events: write only. - codeql-action pinned to the same v3 SHA already used by scorecard.yml; checkout pinned by SHA. Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> Assisted-By: Claude <noreply@anthropic.com>
CodeQL 2.25.x rejects build-mode 'none' for Go ('Go does not support the
none build mode; use autobuild or manual'), which failed the initial run.
Switch to autobuild and add a SHA-pinned setup-go (go-version-file: go.mod)
so the autobuilder uses the project's Go toolchain rather than whatever the
runner ships. go build ./... already compiles cleanly, so autobuild
succeeds.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Assisted-By: Claude <noreply@anthropic.com>
myasnikovdaniil
force-pushed
the
ci/scorecard-codeql
branch
from
56fd486 to
0d6aaf9
Compare
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
NOT LGTM — the workflow itself runs green and the hardening (read-only token, SHA pins, persist-credentials: false) checks out, but it pins a CodeQL Action major that its own run already flags as deprecated, and the in-file comments contradict the observed runtime behavior.
Business context: raises the OpenSSF Scorecard SAST check (currently 0/10) by adding GitHub's CodeQL analysis for Go, the SAST tool Scorecard credits directly.
Blockers
B1: codeql-action pinned to v3, which is already on a deprecation path; v4 is GA
File: .github/workflows/codeql.yml:60,66 (and .github/workflows/scorecard.yml:53)
Issue: both init and analyze pin github/codeql-action@03e4368a (v3.36.0).
Evidence: this PR's own green run prints ##[warning]CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4.
Impact: a brand-new workflow ships with a warning in every run and a guaranteed follow-up PR within months. The warning says "all occurrences": scorecard.yml:53 pins upload-sarif to the same v3 SHA — same fix, same PR.
Fix: bump all three occurrences to the current v4 SHA; verify the rerun is green with no deprecation warning.
B2: in-file comments contradict what the job actually does
File: .github/workflows/codeql.yml:39-43 and :9-10
Issue: the autobuild comment claims it "runs the Go build the same way go build ./... does". The run log shows otherwise: the autobuilder discovered all 5 go.mod files and extracted each module separately (root, api/apps/v1alpha1, plus three nested image modules go build ./... from the root would never touch), and before that it tried make, executing the root Makefile's default goal — which on a depth-1 checkout added an upstream remote and ran a network git fetch upstream --tags (dozens of [new branch] ... -> upstream/... lines in the log). Separately, the cron comment calls stale a Monday job, but stale.yaml runs 37 4 * * * — daily.
Evidence: run 27197771777 logs (extractor invoked per-module; fetch lines), stale.yaml schedule in main.
Impact: the comments are the only documentation of this workflow's behavior; a future maintainer reading them concludes coverage is narrower than it is and misses that the job executes the repo Makefile with network side effects.
Fix: rewrite the autobuild comment to state: autobuild discovers every go.mod and extracts each module (nested image modules included) and attempts make from the repo root; fix or drop the stale reference in the cron comment.
Non-blocking follow-ups
- The PR body still argues for
build-mode: none("Why build-mode: none" section), but the branch switched toautobuildin its second commit — please update the body so the recorded rationale matches what ships. actions/checkoutis pinned to v4.3.1 while scorecard.yml — the only other SHA-pinned workflow — is on v6; for a new file consider starting at v6 so the security workflows track one version.concurrency.group: codeql-${{ github.workflow }}-${{ github.ref }}expands tocodeql-CodeQL-<ref>— the hardcoded prefix duplicates the workflow name. Cosmetic.- No
pathsfilter means ~5 min of CodeQL on every PR including Helm/docs-only ones. That matches GitHub's own guidance (path filters break required-check semantics), just noting it as a known tradeoff.
Verified while reviewing: all three SHA pins resolve to the tags their comments claim (checkout v4.3.1, setup-go v5.6.0, codeql-action v3.36.0); the Analyze (go) job passed on this PR's HEAD in 5m1s with SARIF uploaded; coverage is actually better than the comment claims (all 5 modules extracted); go-version-file: go.mod is consistent across all module files (go 1.26.2).
| cache: false | ||
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3 |
There was a problem hiding this comment.
This PR's own run warns: CodeQL Action v3 will be deprecated in December 2026... update all occurrences to v4. Current v4 is GA — please pin the v4 SHA here, on analyze below, and on upload-sarif in scorecard.yml:53 (same SHA, same warning).
There was a problem hiding this comment.
Done in e40db8c — init, analyze, and scorecard.yml's upload-sarif are now pinned to the v4.36.2 commit SHA (8aad20d), the current GA release, so the v3 deprecation warning is gone.
| # runs the Go build the same way `go build ./...` does — the repo | ||
| # already compiles cleanly there, including the committed generated | ||
| # files. setup-go below pins the toolchain to the go.mod version so | ||
| # autobuild does not fall back to whatever Go the runner ships. |
There was a problem hiding this comment.
The run log contradicts this comment: autobuild discovered all 5 go.mod files and extracted each module separately (including the three nested image modules that go build ./... from the root never touches), and it first attempted make, which executed the root Makefile and ran a network git fetch upstream --tags on the runner. Coverage is better than stated, but the mechanism is different — please rewrite to describe the actual behavior.
There was a problem hiding this comment.
Rewritten in 445a2fb. The comment now states autobuild discovers every go.mod and extracts each module separately (root, api/apps/v1alpha1, and the three nested image modules a root go build ./... never reaches), and that it first attempts make from the repo root — which runs the default Makefile goal, including the network git fetch upstream --tags — before falling back to the Go build.
| branches: [main] | ||
| schedule: | ||
| # Weekly, off-peak and offset from the other Monday cron jobs | ||
| # (scorecard 06:00, labels 04:17, stale 04:37). |
There was a problem hiding this comment.
stale.yaml runs 37 4 * * * — daily, not Mondays. The 03:27 Monday slot itself is fine; just fix the comment.
There was a problem hiding this comment.
Fixed in 6b12123. The comment now lists scorecard (06:00 Mon) and labels (04:17 Mon) as the Monday jobs and notes stale (04:37) runs daily.
…warning Address review feedback from lexfrei on .github/workflows/codeql.yml:60: v3 is on a deprecation path (the workflow's own run already warns about it) and v4 is GA. Bump init, analyze, and scorecard.yml's upload-sarif to the same v4.36.2 commit SHA. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Address review feedback from lexfrei on .github/workflows/codeql.yml:43: the previous comment claimed autobuild 'runs the Go build the same way go build ./... does'. The run log shows autobuild discovers all five go.mod files and extracts each module separately (including the three nested image modules a root build never reaches), and first attempts make from the repo root, which triggers a network git fetch upstream --tags. Rewrite the comment to document this accurately. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Address review feedback from lexfrei on .github/workflows/codeql.yml:10: stale.yaml runs '37 4 * * *' (daily), but the comment listed it among the other Monday cron jobs. Note scorecard and labels as the Monday jobs and stale as daily. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
…urrency prefix Address non-blocking review feedback from lexfrei: bump actions/checkout to the v6.0.2 SHA already used by scorecard.yml so the security workflows track one version, and remove the hardcoded 'codeql-' prefix from the concurrency group (github.workflow already expands to 'CodeQL'). Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
|
Aleksei Sviridkin (@lexfrei) Thanks for the detailed review — all three blockers are addressed, plus the non-blocking follow-ups:
PTAL. |
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
LGTM — both blockers from my prior review are resolved and verified at HEAD; one new minor warning remains, non-blocking.
Business context: raises the OpenSSF Scorecard SAST check (was 0/10) by adding GitHub's CodeQL static analysis for Go.
Resolved since the last review
- B1 (codeql-action v3 deprecation) —
init+analyze(codeql.yml) andupload-sarif(scorecard.yml) are now all pinned to8aad20d # v4.36.2. Verified the pin is genuine: thev4.36.2annotated tag peels to commit8aad20d…and the tags API confirms8aad20dcarriesv4.36.2+v4. The HEAD run (Analyze (go), run 27817668316) is green in 5m2s and its annotations no longer contain theCodeQL Action v3 will be deprecatedwarning. - B2 (comments contradicted runtime behavior) — the autobuild comment now states it discovers every
go.mod, extracts each module (root,api/apps/v1alpha1, the three nested image modules) and first attemptsmakefrom the repo root (networkgit fetch upstream --tags) before the Go build; the cron comment now correctly labelsstaleas a daily04:37job. Both match the observed run. - Prior non-blocking items also addressed: the body rationale switched to "Why autobuild";
actions/checkoutpinned tode0fac2e # v6.0.2(matchesscorecard.yml); theconcurrency.groupdropped the redundantcodeql-prefix.
Verified pins at HEAD: checkout de0fac2e = v6.0.2, setup-go 40f1582b = v5.6.0, codeql-action 8aad20d = v4.36.2 (all three refs).
Non-blocking follow-up
- The HEAD run still emits one warning per run:
actions/setup-go@40f1582b(v5.6.0) targets Node 20 and is force-run on Node 24 (GitHub's Sept-2025 Node-20 runner deprecation).actions/setup-go@v6.4.0runs on Node 24 natively — bumping clears the last "warning in every run", in the same spirit as the codeql v4 bump that fixed B1. Ecosystem-wide rather than specific to this PR, so purely optional.
3 participants
What this PR does
Raises the OpenSSF Scorecard SAST check (was 0/10) by adding GitHub's recommended CodeQL static analysis for Go. CodeQL is free for public repositories and is the SAST tool Scorecard recognizes directly.
main, PRs tomain, and a weekly schedule (Mon 03:27 UTC, offset from the other Monday cron jobs).github/codeql-action/analyze.Why
autobuildThe Go analysis uses
build-mode: autobuild. Go's CodeQL extractor only supportsautobuildormanual(notnone), so autobuild is the low-friction choice. It discovers everygo.modin the tree and extracts each module separately — the root module,api/apps/v1alpha1, and the three nested image modules a rootgo build ./...never reaches — giving broader coverage than a single root build. Before falling back to the Go build it first attemptsmakefrom the repo root, which runs the default Makefile goal (including a networkgit fetch upstream --tags).setup-gopins the toolchain to thego.modversion so the extractor uses the project's Go rather than whatever the runner ships.Security posture
analyzejob opts intosecurity-events: write(pluscontents: read,actions: read) only.actions/checkoutis pinned to v6.0.2 (matchingscorecard.yml) withpersist-credentials: false.codeql-action/initand/analyzeare pinned to the v4.36.2 SHA — the same commit asscorecard.yml'supload-sarif, keeping every codeql-action ref in the repo on one commit and clear of the v3 deprecation warning.Verification
actionlint: exit 0.run:steps → no untrusted-input injection surface.Release note
Summary by CodeRabbit