Add CodeQL workflow; document CI release flow as the process#55
Merged
Conversation
…rototype) - Add .github/workflows/codeql.yml: static analysis for GitHub Actions and Java (Tycho build, no tests), matching the org's CodeQL setup. - Reframe docs/RELEASING.md around the CI->Pages composite flow as the actual release process (it shipped v5.4.0), with the committed update site marked legacy; drop "prototype" wording from release.yml too. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015krtPy49YGqBERvq4yDjCa
There was a problem hiding this comment.
Pull request overview
This PR adds CodeQL scanning to the repository’s CI and updates the release documentation to describe the CI→GitHub Pages composite p2 update-site flow as the primary/official release process (with the old committed update-site flow marked as legacy).
Changes:
- Add a new GitHub Actions CodeQL workflow to scan both GitHub Actions workflows and the Java codebase.
- Reframe
docs/RELEASING.mdaround the CI-published release workflow and mark the committed update site as legacy/retiring. - Remove “PROTOTYPE” wording from the release workflow header comment.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
docs/RELEASING.md |
Rewrites release documentation to center the CI→Pages composite update-site process and de-emphasize the legacy committed update site. |
.github/workflows/release.yml |
Updates workflow header comment to remove “prototype” framing. |
.github/workflows/codeql.yml |
Adds CodeQL analysis for Actions workflows and Java (manual Tycho build step). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| 2. Update the README's update-site URL to the Pages composite URL. | ||
| 3. Optionally seed `gh-pages` with the existing historical versions (one child dir per past release) so nothing 404s, then **drop the committed `updatesite/` binaries** from `master` going forward (and, if desired, purge them from history). | ||
| 4. Retire `release.sh` (or keep as an offline fallback). | ||
| 1. Drop the committed `updatesite/` binaries from `master` (history is preserved on `gh-pages` under `releases/archive/`). |
Comment on lines
+3
to
+5
| # Static security analysis. Scans GitHub Actions workflows and the Java code. | ||
| # The Java analysis builds with Tycho (autobuild can't resolve the target | ||
| # platform), mirroring maven.yml's install step minus tests. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small improvements identified in review.
CodeQL (#1)
Adds
.github/workflows/codeql.yml— static security analysis for GitHub Actions workflows and Java. The Java analysis builds with Tycho (no tests), since autobuild can't resolve the target platform. Common previously had no CodeQL (its sibling Hybridize does).De-"prototype" the release docs (#3)
The CI→Pages composite flow already shipped v5.4.0, so it's no longer a prototype.
docs/RELEASING.mdis reframed around it as the actual process (with a "How to Cut a Release" section), the committed update site is marked legacy / being retired, and the "PROTOTYPE" wording is dropped fromrelease.yml's header.Verified: both workflows valid YAML;
spotless:checkgreen.🤖 Generated with Claude Code