From e5bb8077b9d78849ff995e9f32cb020ed4326f27 Mon Sep 17 00:00:00 2001 From: RishavTiwari25 Date: Thu, 19 Mar 2026 10:50:11 +0530 Subject: [PATCH 1/5] ci: enable CodeQL SAST scanning for automated security analysis --- .github/workflows/codeql.yml | 42 ++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000000..335b0092990 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,42 @@ +name: "CodeQL SAST Scanning" + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '0 0 * * 0' # Run weekly on Sundays + +permissions: + contents: read + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'rust' ] + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + build-mode: autobuild + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" From f3e3ffbc8b4057b9d292474a9c725c6f1c7c6f6a Mon Sep 17 00:00:00 2001 From: RishavTiwari25 Date: Thu, 19 Mar 2026 10:54:49 +0530 Subject: [PATCH 2/5] ci: fix CodeQL build mode and update action versions --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 335b0092990..81529b5ac9f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,12 +31,12 @@ jobs: uses: actions/checkout@v4 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} - build-mode: autobuild + build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 with: category: "/language:${{matrix.language}}" From 6e9b66b7a0c7bde01507ef4b4a729866bf5f225b Mon Sep 17 00:00:00 2001 From: RishavTiwari25 Date: Fri, 20 Mar 2026 16:51:56 +0530 Subject: [PATCH 3/5] ci: remove push and pr triggers from CodeQL to save CI capacity --- .github/workflows/codeql.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 81529b5ac9f..870ca7c3f6d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,10 +1,7 @@ name: "CodeQL SAST Scanning" on: - push: - branches: [ "main" ] - pull_request: - branches: [ "main" ] + workflow_dispatch: schedule: - cron: '0 0 * * 0' # Run weekly on Sundays From bd0530d3be5768811b129e07c49c30027e7ae7f5 Mon Sep 17 00:00:00 2001 From: RishavTiwari25 Date: Fri, 20 Mar 2026 17:23:31 +0530 Subject: [PATCH 4/5] ci: pin GitHub Actions to commit SHAs for supply chain security --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 870ca7c3f6d..f38bdb92966 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,15 +25,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4 with: languages: ${{ matrix.language }} build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4 with: category: "/language:${{matrix.language}}" From 27ff8711a324a857745791587b66bde50e31a9e0 Mon Sep 17 00:00:00 2001 From: RishavTiwari25 Date: Fri, 20 Mar 2026 18:43:35 +0530 Subject: [PATCH 5/5] ci: bump actions/checkout to v6 SHA, codeql-action to v4.34.0, add persist-credentials --- .github/workflows/codeql.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f38bdb92966..e0031be37b0 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -25,15 +25,17 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4 + uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 with: languages: ${{ matrix.language }} build-mode: none - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4 + uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0 with: category: "/language:${{matrix.language}}"