Skip to content

chore(ci): add CodeQL security analysis workflow #367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
CodeGhost21 wants to merge 2 commits into from
Closed

chore(ci): add CodeQL security analysis workflow #367

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cf9e341
chore(ci): add CodeQL security analysis workflow
CodeGhost21 Apr 6, 2026
03742d9
fix(ci): align CodeQL workflow with repo languages and v4 actions
CodeGhost21 Apr 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
name: CodeQL

on:
push:
branches: [main]
pull_request:
branches: [main]
schedule:
# Weekly drift scan — Saturdays at 09:37 UTC
- cron: '37 9 * * 6'
Comment on lines +9 to +10
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Schedule does not match the stated PR objective.

Line 10 is configured for Saturday 09:37 UTC, but the PR objective states a weekly run on Sunday 04:30 UTC. Please align code and PR documentation to avoid ops confusion.

🔧 Suggested change (if the objective is the source of truth) 
-    # Weekly drift scan — Saturdays at 09:37 UTC
-    - cron: '37 9 * * 6'
+    # Weekly drift scan — Sundays at 04:30 UTC
+    - cron: '30 4 * * 0'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Weekly drift scan — Saturdays at 09:37 UTC
- cron: '37 9 * * 6'
# Weekly drift scan — Sundays at 04:30 UTC
- cron: '30 4 * * 0'
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/codeql.yml around lines 9 - 10, The workflow cron schedule
and its comment are out of sync with the PR objective; update the cron entry
currently set to '37 9 * * 6' in .github/workflows/codeql.yml to the Sunday
04:30 UTC schedule '30 4 * * 0' and change the accompanying comment "Weekly
drift scan — Saturdays at 09:37 UTC" to "Weekly drift scan — Sundays at 04:30
UTC" so the code and documentation match (ensure UTC is preserved).


permissions:
contents: read
security-events: write
packages: read
actions: read

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref || github.ref }}
cancel-in-progress: true

jobs:
analyze:
name: Analyze (${{ matrix.language }})
runs-on: ubuntu-latest

strategy:
fail-fast: false
matrix:
include:
- language: actions
build-mode: none
- language: javascript-typescript
build-mode: none
- language: rust
build-mode: none
# Ruby excluded — only a single Homebrew formula file exists.

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
queries: security-and-quality

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
with:
category: '/language:${{ matrix.language }}'
Loading