Create CodeQL workflow file by involvex · Pull Request #12 · involvex/nova-assistant

involvex · 2026-09-17T20:37:22Z

Summary by Sourcery

CI:

Add a GitHub Actions workflow that runs CodeQL security analysis for Java and Kotlin changes on pushes and pull requests targeting main, plus a weekly scheduled scan.

changeset-bot · 2026-09-17T20:37:27Z

⚠️ No Changeset found

Latest commit: 8c2dea7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

sourcery-ai · 2026-09-17T20:37:27Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

The pull request adds a new GitHub Actions workflow intended to run CodeQL security analysis; review the workflow triggers, language configuration, permissions, and build/analysis steps for correctness.

File-Level Changes

Change	Details	Files
Adds a GitHub Actions workflow for automated CodeQL security analysis.	Creates a workflow file under the GitHub Actions workflows directory. Configures CodeQL analysis to run through the repository’s CI workflow mechanism.	`"b/.github/workflows\\codeql-analysis.yml"`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

sourcery-ai

Hey - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

kilo-code-bot · 2026-09-17T20:41:05Z

+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3


WARNING: Using deprecated actions/checkout@v3

The rest of the repository's workflows (ci.yml, docs.yml, release.yml) use actions/checkout@v4. Version 3 is deprecated and may stop working in the future. Update to v4 for consistency and continued support.

Suggested change

uses: actions/checkout@v3

uses: actions/checkout@v4

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

Fixed in 29b2497.

kilo-code-bot · 2026-09-17T20:41:05Z

+      uses: actions/checkout@v3
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2


WARNING: Using older CodeQL action version v2

GitHub recommends using v3 for github/codeql-action/init, github/codeql-action/autobuild, and github/codeql-action/analyze. Version 2 may lack security fixes and new features.

Suggested change

uses: github/codeql-action/init@v2

uses: github/codeql-action/init@v3

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

Fixed in 9e856ab.

kilo-code-bot · 2026-09-17T20:41:05Z

+        languages: ${{ matrix.language }}
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2


WARNING: Using older CodeQL action version v2

Update to v3 for consistency with the init action and to get the latest fixes.

Suggested change

uses: github/codeql-action/autobuild@v2

uses: github/codeql-action/autobuild@v3

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

Fixed in 7aa81e1.

kilo-code-bot · 2026-09-17T20:41:05Z

+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2


WARNING: Using older CodeQL action version v2

Update to v3 for consistency and latest security fixes.

Suggested change

uses: github/codeql-action/analyze@v2

uses: github/codeql-action/analyze@v3

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

Fixed in 330f564.

kilo-code-bot · 2026-09-17T20:41:05Z

+      with:
+        languages: ${{ matrix.language }}
+
+    - name: Autobuild


SUGGESTION: Autobuild may not work for Flutter/Gradle projects

The autobuild action attempts to automatically build compiled languages but may not correctly handle Flutter's Gradle-based Android build. The commented section acknowledges this but doesn't provide Flutter-specific build commands. Consider adding explicit build steps for the Android module:

- name: Setup Java uses: actions/setup-java@v4 with: distribution: temurin java-version: 17 - name: Build Android run: | cd android ./gradlew assembleDebug

This ensures the Kotlin code is properly compiled before CodeQL analysis.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

Fixed in 6b4b304.

SUGGESTION: Autobuild may not work for Flutter/Gradle projects

The autobuild action attempts to automatically build compiled languages but may not correctly handle Flutter's Gradle-based Android build. The commented section acknowledges this but doesn't provide Flutter-specific build commands. Consider adding explicit build steps for the Android module:

- name: Setup Java uses: actions/setup-java@v4 with: distribution: temurin java-version: 17 - name: Build Android run: | cd android ./gradlew assembleDebug

This ensures the Kotlin code is properly compiled before CodeQL analysis.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

@kilocode-bot fix it

To use Kilo from GitHub you first need to link your GitHub account to Kilo. Link your Kilo account to continue. After linking, mention me again in this issue or pull request.

I couldn't apply this fix automatically this time.

I could not start this fix because the account needs at least $1 in available credits.

Next steps:

Add credits to your Kilo account, then retry the fix.

Session ID: agent_74b257bb-2819-4ad9-b67d-116535aef191

Technical details

Insufficient credits. Auto-fix requires at least $1 in available credits. Add credits, then retry.

kilo-code-bot · 2026-09-17T20:41:18Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

.github/workflows/codeql-analysis.yml

Previous Review Summaries (2 snapshots, latest commit 6446b6a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `6446b6a`)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

.github/workflows/codeql-analysis.yml - 0 issues (previous WARNING about missing Kotlin in matrix has been fixed)

Previous review (commit `6321e3e`)

Status: 6 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	5
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
`.github/workflows\codeql-analysis.yml`	27	Using deprecated `actions/checkout@v3`
`.github/workflows\codeql-analysis.yml`	30	Using older CodeQL action version `v2` (init)
`.github/workflows\codeql-analysis.yml`	35	Using older CodeQL action version `v2` (autobuild)
`.github/workflows\codeql-analysis.yml`	46	Using older CodeQL action version `v2` (analyze)
`.github/workflows\codeql-analysis.yml`	23	Matrix only includes 'java' but project has substantial Kotlin code

SUGGESTION

File	Line	Issue
`.github/workflows\codeql-analysis.yml`	34	Autobuild may not work for Flutter/Gradle projects

Files Reviewed (1 file)

.github/workflows\codeql-analysis.yml - 6 issues

Fix these issues in Kilo Cloud

_{Reviewed by free · Input: 0 · Output: 0 · Cached: 0}

Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>

Create CodeQL workflow file

6321e3e

sourcery-ai Bot reviewed Sep 17, 2026

View reviewed changes

kilo-code-bot Bot reviewed Sep 17, 2026

View reviewed changes

involvex and others added 7 commits September 17, 2026 22:43

Update .github/workflows\codeql-analysis.yml

6446b6a

Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>

Merge branch 'main' into gh-code-scanning/codeql-analysis

1bb32f8

fix(ci): update checkout action to v4

df7447e

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>

fix(ci): update codeql init action to v3

f38f614

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>

fix(ci): update codeql autobuild action to v3

ef6f0fa

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>

fix(ci): update codeql analyze action to v3

5d32c17

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>

fix(ci): replace autobuild with explicit gradle build

8c2dea7

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>

involvex assigned involvex and Claude Sep 17, 2026

involvex merged commit 0fcc764 into main Sep 17, 2026
8 of 10 checks passed

	uses: github/codeql-action/init@v2
	uses: github/codeql-action/init@v3

	uses: github/codeql-action/autobuild@v2
	uses: github/codeql-action/autobuild@v3

	uses: github/codeql-action/analyze@v2
	uses: github/codeql-action/analyze@v3

Uh oh!

Conversation

involvex commented Sep 17, 2026 • edited by sourcery-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Sourcery

Uh oh!

changeset-bot Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

sourcery-ai Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

involvex Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

involvex Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

involvex Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

involvex Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kilo-code-bot Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

involvex Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

involvex Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Previous review (commit 6446b6a)

Previous review (commit 6321e3e)

Overview

WARNING

SUGGESTION

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

involvex commented Sep 17, 2026 •

edited by sourcery-ai Bot

Loading

changeset-bot Bot commented Sep 17, 2026 •

edited

Loading

sourcery-ai Bot commented Sep 17, 2026 •

edited

Loading

kilo-code-bot Bot commented Sep 17, 2026 •

edited

Loading

Previous review (commit `6446b6a`)

Previous review (commit `6321e3e`)