Repository navigation
Conversation
Adds .github/workflows/codeql.yml: CodeQL for javascript-typescript, rust (build-mode none; Rust is generally available in CodeQL and the default setup uses no build) and the workflow files (actions), on pull requests, on pushes to main and weekly. Actions pinned to commit SHAs with the version in a comment, as release.yml does. .github/codeql/codeql-config.yml keeps generated code, fixtures, build output and the i18n loaders out of the analysis so findings land in hand-written code. Co-Authored-By: Claude Fable 5.1 <[email protected]> Signed-off-by: Madraka <[email protected]>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Sets up GitHub code scanning with CodeQL (
.github/workflows/codeql.yml+.github/codeql/codeql-config.yml). The repository had none ("no analysis found" on the code-scanning API). Three analyses run as a matrix on every pull request, on every push tomainand weekly (Monday 05:17 UTC):javascript-typescript(build-mode: none),rust(build-mode: none): Rust is generally available in CodeQL (editions 2021 and 2024, TypeScript up to 7.0); GitHub's own default setup analyses Rust without a build, and the extractor only needs therustup/cargoalready onubuntu-latest. Nothing on the free tier of a public repository limits it, so it is on. If it ever turns out slow or noisy, drop the matrix row.actions: CodeQL's workflow-injection and untrusted-checkout queries for.github/workflows.Details:
permissions: {}at the top,contents: read+security-events: writeon the job (packages: readandactions: readonly matter on private repositories).release.yml:actions/checkoutv7.0.1 (the SHA already used there) andgithub/codeql-actionv4.39.3 (33d7b85…, the commitrefs/tags/v4.39.3dereferences to). Dependabot'sgithub-actionsentry keeps them current.timeout-minutes: 30,fail-fast: false,concurrencyper ref with cancel-in-progress.**/generated/**(schema output, i18n params),apps/studio/src/i18n/loaders/**,**/fixtures/**,**/dist/**,**/__snapshots__/**,target/**,.i18n/**andnode_modules, so findings point at hand-written code.Owner action: for results to appear under Security › Code scanning (and as PR checks), the repository's default setup must stay off (advanced setup and default setup conflict), and code scanning must be enabled for the repository: Settings › Code security › Code scanning. On a public repository this is free and usually on by default once a workflow uploads a SARIF; if the first run fails at the upload step with a "code scanning is not enabled" error, enable it there and re-run. The first PR run will show the three
Analyze (…)checks on this PR.Checklist
pnpm lintpasses on the new files (Biome does not format YAML here,biome.json);pnpm checkandcargo testdo not apply to a workflow-only changegit commit -s, DCO)🤖 Generated with Claude Code