From de08d0b3028a27d97975a798e718a26361c17e3c Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 22 Oct 2026 16:30:24 +0000 Subject: [PATCH] =?UTF-8?q?ci(devcontainer-features-githooks):=20?= =?UTF-8?q?=F0=9F=91=B7=20add=20a=20CodeQL=20workflow=20with=20the=20fewes?= =?UTF-8?q?t=20runs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit check-codeql.yml replaces GitHub's default setup: pull requests to a long-lived branch that are ready for review and touch an analyzable file (paths), plus a weekly scan and a manual run for the baseline; nothing on a push. build-mode none, one job per language, concurrency cancels superseded runs. Declared as a githooks stub and dogfooded here with the python language this repo also uses. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_011utfJEcSv7pCD1sxg3ihmL --- .github/workflows/check-codeql.yml | 61 +++++++++++++++++++ src/githooks/README.md | 1 + .../stubs/.github/workflows/check-codeql.yml | 60 ++++++++++++++++++ 3 files changed, 122 insertions(+) create mode 100644 .github/workflows/check-codeql.yml create mode 100644 src/githooks/stubs/.github/workflows/check-codeql.yml diff --git a/.github/workflows/check-codeql.yml b/.github/workflows/check-codeql.yml new file mode 100644 index 00000000..8ddb1474 --- /dev/null +++ b/.github/workflows/check-codeql.yml @@ -0,0 +1,61 @@ +# @format + +name: CodeQL + +# Fewest possible runs. A pull request is only scanned when it is ready for +# review (drafts are skipped), targets a long-lived branch, and touches a file +# CodeQL can analyze - `paths` only decides whether the workflow runs, it does +# not narrow what is analyzed. Nothing runs on a push to a long-lived branch: +# the weekly scan (and a manual run) refresh the baseline the pull requests are +# compared against. +on: + pull_request: + types: [opened, reopened, synchronize, ready_for_review] + branches: [main, develop] + paths: + - '.github/workflows/**' + - '**/action.yml' + - '**/action.yaml' + - '**/*.py' + schedule: + - cron: '17 4 * * 1' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + # schedule and workflow_dispatch have no pull request: only drafts are skipped. + if: github.event_name != 'pull_request' || !github.event.pull_request.draft + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + actions: read + security-events: write + strategy: + fail-fast: false + matrix: + # Add a language here (and its files to `paths` above) when the repo has code in it. + language: [actions, python] + steps: + - uses: actions/checkout@v7 + + # Pinned to a commit: the action's tags are mutable. + - name: Initialize CodeQL + uses: github/codeql-action/init@8498dc4c2b27cdd99baf0f87955b29ebbf30c78d # v4.39.1 + with: + languages: ${{ matrix.language }} + # No build: the languages scanned here are interpreted. + build-mode: none + + - name: Analyze + uses: github/codeql-action/analyze@8498dc4c2b27cdd99baf0f87955b29ebbf30c78d # v4.39.1 + with: + category: /language:${{ matrix.language }} diff --git a/src/githooks/README.md b/src/githooks/README.md index 37a0cb41..12f8ab52 100644 --- a/src/githooks/README.md +++ b/src/githooks/README.md @@ -97,6 +97,7 @@ Consumer repos get these deployed workflows under `.github/workflows/`. Each has - `validate-pr-format.yml` — checks the PR title (commitlint + devmoji) and the PR source branch. - `validate-pr-secret.yml` — scans the PR for secrets with gitleaks on open, reopen and every push; skipped when `GITLEAKS_LICENSE` is not set. - `validate-pr-vulnerabilities.yml` — scans the PR with [Trivy](https://github.com/aquasecurity/trivy-action) (dependencies, IaC misconfigurations, secrets) when the PR is marked ready for review, and fails on fixable HIGH/CRITICAL findings and uploads the SARIF report to the Security tab; the action is pinned to a commit. +- `check-codeql.yml` — [CodeQL](https://docs.github.com/en/code-security/reference/code-scanning/workflow-configuration-options) code scanning with the fewest runs: pull requests to `main`/`develop` that are ready for review (not drafts) and touch an analyzable file (`paths`), plus a weekly scan and a manual run that refresh the baseline; nothing runs on a push. Scans `actions` by default; add a language to the `language` matrix and its files to `paths`. It replaces GitHub's default setup, which must be turned off in the repository's code security settings. - `update-labels.yml` — weekly sync of `.github/labels.json` to the repository labels (needs only `issues: write`). - `clean-branches.yml` — weekly deletion of branches whose pull request is closed. - `configure-github.yml` — weekly restriction of `main` to the GitHub Actions bot. diff --git a/src/githooks/stubs/.github/workflows/check-codeql.yml b/src/githooks/stubs/.github/workflows/check-codeql.yml new file mode 100644 index 00000000..fc5e27d5 --- /dev/null +++ b/src/githooks/stubs/.github/workflows/check-codeql.yml @@ -0,0 +1,60 @@ +# @format + +name: CodeQL + +# Fewest possible runs. A pull request is only scanned when it is ready for +# review (drafts are skipped), targets a long-lived branch, and touches a file +# CodeQL can analyze - `paths` only decides whether the workflow runs, it does +# not narrow what is analyzed. Nothing runs on a push to a long-lived branch: +# the weekly scan (and a manual run) refresh the baseline the pull requests are +# compared against. +on: + pull_request: + types: [opened, reopened, synchronize, ready_for_review] + branches: [main, develop] + paths: + - '.github/workflows/**' + - '**/action.yml' + - '**/action.yaml' + schedule: + - cron: '17 4 * * 1' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + # schedule and workflow_dispatch have no pull request: only drafts are skipped. + if: github.event_name != 'pull_request' || !github.event.pull_request.draft + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + actions: read + security-events: write + strategy: + fail-fast: false + matrix: + # Add a language here (and its files to `paths` above) when the repo has code in it. + language: [actions] + steps: + - uses: actions/checkout@v7 + + # Pinned to a commit: the action's tags are mutable. + - name: Initialize CodeQL + uses: github/codeql-action/init@8498dc4c2b27cdd99baf0f87955b29ebbf30c78d # v4.39.1 + with: + languages: ${{ matrix.language }} + # No build: the languages scanned here are interpreted. + build-mode: none + + - name: Analyze + uses: github/codeql-action/analyze@8498dc4c2b27cdd99baf0f87955b29ebbf30c78d # v4.39.1 + with: + category: /language:${{ matrix.language }}