ci: add a codeql workflow#1148
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
clementb49
marked this pull request as ready for review
April 12, 2026 10:13
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughPins several GitHub Actions to specific commit SHAs, adds a new CodeQL Advanced workflow, switches the copilot-setup job runner to Windows, and inserts explicit Python bytecode compilation steps into CI workflows. Changes
Sequence Diagram(s)sequenceDiagram
participant Repo as Repo (checkout)
participant Runner as Runner (ubuntu/windows)
participant UV as UV (astral-sh/setup-uv)
participant Compile as Compile (python -m compileall)
participant CodeQLInit as CodeQL Init (github/codeql-action/init)
participant CodeQLAn as CodeQL Analyze (github/codeql-action/analyze)
Note over Repo,Runner: CodeQL Advanced workflow (matrix: actions/python)
Repo->>Runner: checkout repository
Runner->>UV: setup uv & uv sync (install deps)
Runner->>Compile: uv run -m compileall (.\basilisk, .\tests)
Runner->>CodeQLInit: init CodeQL (query packs & analysis-kinds)
Runner->>CodeQLAn: run CodeQL analyze
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 56: Replace mutable action tags with immutable commit SHAs: find the
three usages actions/checkout@v4, github/codeql-action/init@v4, and
github/codeql-action/analyze@v4 in the CodeQL workflow and pin each to the
corresponding full commit SHA for that action (the same pattern used for
astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57). For each
identifier (actions/checkout, github/codeql-action/init,
github/codeql-action/analyze) look up the latest stable release commit on the
action's GitHub repo, replace the `@v4` tag with @<full-commit-sha>, and run a
workflow lint/quick test to ensure the pinned refs are valid.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: e804c75d-8dd6-4974-97d0-b29e84c0cd31
📒 Files selected for processing (5)
.github/workflows/build_app.yml.github/workflows/codeql.yml.github/workflows/copilot-setup-steps.yml.github/workflows/localization.yml.github/workflows/ruff.yml
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
.github/workflows/codeql.yml (1)
77-77:⚠️ Potential issue | 🟠 MajorPin
github/codeql-actionrefs to immutable SHAs.This workflow still uses mutable
@v4tags forinitandanalyzein a security-critical pipeline.#!/bin/bash # Verify mutable refs still present in CodeQL workflow. rg -n 'uses:\s*github/codeql-action/(init|analyze)@v[0-9]+' .github/workflows/codeql.yml # Expected after fix: no matchesAlso applies to: 107-107
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/codeql.yml at line 77, The workflow is using mutable tags github/codeql-action/init@v4 and github/codeql-action/analyze@v4; replace both uses entries with the corresponding immutable commit SHAs for the v4 release (i.e., change github/codeql-action/init@v4 → github/codeql-action/init@<SHA> and github/codeql-action/analyze@v4 → github/codeql-action/analyze@<SHA>), ensuring you pick the canonical commit SHA from the CodeQL Action repo for the v4 release so the workflow is pinned to immutable refs.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 5-7: The YAML branch lists under the keys "branches" for both the
workflow and pull_request entries have spacing that violates the linter; update
them to use proper YAML sequence formatting by replacing bracketed inline lists
like branches: [ "master" ] with either a plain sequence (branches: - master) or
a compact, lint-acceptable inline form without extra spaces (branches:
["master"]); modify the entries associated with the "branches" keys in the
workflow definition to use one of these valid formats so the YAML linter passes.
In @.github/workflows/localization.yml:
- Around line 26-28: The upload_on_crowdin job is using the mutable
actions/checkout@v6 which can drift; update the workflow to pin it to the same
commit used elsewhere by replacing the actions/checkout reference in the
upload_on_crowdin job with the commit SHA
de0fac2e4500dabe0009e67214ff5f5447ce83dd so both generate_pot and
upload_on_crowdin use the identical pinned action; locate the upload_on_crowdin
job and change its uses value for actions/checkout accordingly.
---
Duplicate comments:
In @.github/workflows/codeql.yml:
- Line 77: The workflow is using mutable tags github/codeql-action/init@v4 and
github/codeql-action/analyze@v4; replace both uses entries with the
corresponding immutable commit SHAs for the v4 release (i.e., change
github/codeql-action/init@v4 → github/codeql-action/init@<SHA> and
github/codeql-action/analyze@v4 → github/codeql-action/analyze@<SHA>), ensuring
you pick the canonical commit SHA from the CodeQL Action repo for the v4 release
so the workflow is pinned to immutable refs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 39c59a5f-6efc-4639-875a-9383f9cd357f
📒 Files selected for processing (6)
.github/workflows/build_app.yml.github/workflows/codeql.yml.github/workflows/copilot-setup-steps.yml.github/workflows/localization.yml.github/workflows/ruff.yml.github/workflows/update_localization.yml
clementb49
force-pushed
the
customCodeql
branch
from
April 12, 2026 11:24
f62f543 to
5e6bebb
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/codeql.yml (1)
5-7:⚠️ Potential issue | 🟡 MinorFix inline branch list spacing to satisfy YAML lint.
At Line 5 and Line 7,
[ "master" ]violates the bracket-spacing rule.Proposed fix
- branches: [ "master" ] + branches: ["master"] @@ - branches: [ "master" ] + branches: ["master"]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/codeql.yml around lines 5 - 7, The YAML linter flags bracket spacing for the branches arrays in the CodeQL workflow; update both occurrences of the branches entries (the top-level branches key and the pull_request.branches key) to use proper YAML array spacing (e.g., remove tight brackets or add spaces around elements) so they conform to the bracket-spacing rule and pass linting; locate the branches arrays in .github/workflows/codeql.yml (the lines defining branches: [ "master" ]) and replace them with the correctly spaced YAML array form.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ruff.yml:
- Line 15: The workflow currently uses astral-sh/ruff-action without an explicit
patch pin ("uses: astral-sh/ruff-action@4919ec5c...") which defers to
pyproject.toml's ruff range; if you want strict patch-level reproducibility, add
the action input with.version set to the desired pinned patch (e.g.,
with.version: "0.15.10") in the same job step that references the action (the
step using astral-sh/ruff-action) so the runner always uses that exact ruff
patch instead of any newer patch within the pyproject.toml range.
---
Duplicate comments:
In @.github/workflows/codeql.yml:
- Around line 5-7: The YAML linter flags bracket spacing for the branches arrays
in the CodeQL workflow; update both occurrences of the branches entries (the
top-level branches key and the pull_request.branches key) to use proper YAML
array spacing (e.g., remove tight brackets or add spaces around elements) so
they conform to the bracket-spacing rule and pass linting; locate the branches
arrays in .github/workflows/codeql.yml (the lines defining branches: [ "master"
]) and replace them with the correctly spaced YAML array form.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 83c9cfde-3c37-45de-b09d-a1199a10b92e
📒 Files selected for processing (7)
.github/workflows/build_app.yml.github/workflows/codeql.yml.github/workflows/copilot-setup-steps.yml.github/workflows/create_release.yml.github/workflows/localization.yml.github/workflows/ruff.yml.github/workflows/update_localization.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Chores