Skip to content

HADOOP-19858: ci: Add CodeQL scanning for github actions#8428

Merged
ajfabbri merged 5 commits intoapache:trunkfrom
ajfabbri:af/codeql-ci
Apr 21, 2026
Merged

HADOOP-19858: ci: Add CodeQL scanning for github actions#8428
ajfabbri merged 5 commits intoapache:trunkfrom
ajfabbri:af/codeql-ci

Conversation

@ajfabbri
Copy link
Copy Markdown
Contributor

@ajfabbri ajfabbri commented Apr 14, 2026

  • ci: Add github-generated CodeQL security scan action
  • ci: modify generated codeql.yml, only scan actions for now

Description of PR

For HADOOP-19858, in #8412, we need help with the tricky task of creating new
github actions for CI with our public repo.

This PR enables CodeQL scanning for our github actions/workflows. For more detail:

https://github.blog/security/application-security/how-to-secure-your-github-actions-workflows-with-codeql/

We can expand the set of languages in the future to include Java, etc.. I'd
like to start by just scanning actions' YAML and see how it goes.

How was this patch tested?

Via this PR.

For code changes:

  • Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
  • Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
  • If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
  • If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

AI Tooling

If an AI tool was used:

@github-advanced-security
Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@ajfabbri ajfabbri marked this pull request as ready for review April 14, 2026 23:38
@ajfabbri ajfabbri changed the title ci: Add CodeQL scanning for github actions HADOOP-19858: ci: Add CodeQL scanning for github actions Apr 14, 2026
@ajfabbri
Copy link
Copy Markdown
Contributor Author

@pan3793 if you like this, we can merge it and it should give us extra feedback on our GH actions development. I wanted some extra help with the security scanning part: This tool should alert us if we make common mistakes during our CI actions development.

@hadoop-yetus
Copy link
Copy Markdown

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 57s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 0s codespell was not available.
+0 🆗 detsecrets 0m 0s detect-secrets was not available.
+0 🆗 yamllint 0m 0s yamllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ trunk Compile Tests _
+1 💚 shadedclient 30m 17s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 shadedclient 26m 32s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 asflicense 0m 35s The patch does not generate ASF License warnings.
60m 13s
Subsystem Report/Notes
Docker ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/1/artifact/out/Dockerfile
GITHUB PR #8428
Optional Tests dupname asflicense codespell detsecrets yamllint
uname Linux 447cd4c6d173 5.15.0-173-generic #183-Ubuntu SMP Fri Mar 6 13:29:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / ce4e774
Max. process+thread count 614 (vs. ulimit of 10000)
modules C: . U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/1/console
versions git=2.43.0 maven=3.9.11
Powered by Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
permissions:
# required for all workflows
security-events: write
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think on.pull_request will limit this to read, so it does not take effect for PR

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review. Hummm. The first commit was generated by GitHub. Do you have a link you can share?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if the workflow was triggered by a pull request event other than pull_request_target from a forked repository, and the Send write tokens to workflows from pull requests setting is not selected, the permissions are adjusted to change any write permissions to read only.

https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#how-permissions-are-calculated-for-a-workflow-job

Copy link
Copy Markdown
Contributor Author

@ajfabbri ajfabbri Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes, the Default config for CodeQL does not support fork pull requests, but the Advanced config is supposed to I think. Related: github/codeql#19698. This PR creates an Advanced config (i.e. we have an explicit codeql action .yml versus the push-putton enabling of Default CodeQL in the github repository settings.)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @pan3793 for helping test this with ajfabbri/hadoop/pull/3 Looks like it works ok. Did you have any problems on your side?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, it works in your forked repo, as you are the owner of that repo. but are you sure we are granted sufficient permission to enable it in apache/hadoop repo? I didn't find this option, which is mentioned by https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning

Image

Copy link
Copy Markdown
Contributor Author

@ajfabbri ajfabbri Apr 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it should work but we need to test. If we get stuck we can ask infra for help. Do you want to merge and try it out, or should I attempt testing on a branch upstream?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not against merging this (but maybe not in its current shape), and we can always revert if it does not work.

BTW, maybe the fastest way to check it is to contact the ASF infra team in Slack?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They are pretty busy but I started a thread here.

Can you please re-review this and let me know if you want particular changes? I left some of the generated comments that I felt would be useful for future authors.

Copy link
Copy Markdown
Contributor Author

@ajfabbri ajfabbri Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW, I think this should just work (in my test advanced security is automatically enabled when you add a relevant workflow). Also note this comment which implies it is active for this apache repo: #8428 (comment)

@ajfabbri
Copy link
Copy Markdown
Contributor Author

@pan3793 here is an example run ajfabbri#1

@hadoop-yetus
Copy link
Copy Markdown

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 58s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 0s codespell was not available.
+0 🆗 detsecrets 0m 0s detect-secrets was not available.
+0 🆗 yamllint 0m 0s yamllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ trunk Compile Tests _
+1 💚 shadedclient 30m 5s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 shadedclient 26m 33s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 asflicense 0m 37s The patch does not generate ASF License warnings.
59m 59s
Subsystem Report/Notes
Docker ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/2/artifact/out/Dockerfile
GITHUB PR #8428
Optional Tests dupname asflicense codespell detsecrets yamllint
uname Linux 97caea8302fa 5.15.0-173-generic #183-Ubuntu SMP Fri Mar 6 13:29:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / 8057c7e
Max. process+thread count 611 (vs. ulimit of 10000)
modules C: . U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/2/console
versions git=2.43.0 maven=3.9.11
Powered by Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

@hadoop-yetus
Copy link
Copy Markdown

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 53s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 0s codespell was not available.
+0 🆗 detsecrets 0m 0s detect-secrets was not available.
+0 🆗 yamllint 0m 0s yamllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ trunk Compile Tests _
+1 💚 shadedclient 36m 32s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 shadedclient 32m 43s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 asflicense 0m 35s The patch does not generate ASF License warnings.
72m 18s
Subsystem Report/Notes
Docker ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/3/artifact/out/Dockerfile
GITHUB PR #8428
Optional Tests dupname asflicense codespell detsecrets yamllint
uname Linux a3bd969248c1 5.15.0-174-generic #184-Ubuntu SMP Fri Mar 13 18:41:50 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / c03003c
Max. process+thread count 574 (vs. ulimit of 10000)
modules C: . U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/3/console
versions git=2.43.0 maven=3.9.11
Powered by Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

Comment thread .github/workflows/codeql.yml
@hadoop-yetus
Copy link
Copy Markdown

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 59s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 0s codespell was not available.
+0 🆗 detsecrets 0m 0s detect-secrets was not available.
+0 🆗 yamllint 0m 0s yamllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ trunk Compile Tests _
+1 💚 shadedclient 31m 8s branch has no errors when building and testing our client artifacts.
-0 ⚠️ patch 31m 29s Used diff version of patch file. Binary files and potentially other changes not applied. Please rebase and squash commits if necessary.
_ Patch Compile Tests _
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 shadedclient 26m 40s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 asflicense 0m 35s The patch does not generate ASF License warnings.
61m 2s
Subsystem Report/Notes
Docker ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/4/artifact/out/Dockerfile
Optional Tests dupname asflicense codespell detsecrets yamllint
uname Linux f3c6f91d3c64 5.15.0-173-generic #183-Ubuntu SMP Fri Mar 6 13:29:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / 21eb8ee
Max. process+thread count 637 (vs. ulimit of 10000)
modules C: . U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/4/console
versions git=2.43.0 maven=3.9.11
Powered by Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

@ajfabbri
Copy link
Copy Markdown
Contributor Author

Added commit which filters pull_request triggers to only happen if something in .github folder changes.

Also rebased on latest trunk.

@hadoop-yetus
Copy link
Copy Markdown

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 57s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 0s codespell was not available.
+0 🆗 detsecrets 0m 0s detect-secrets was not available.
+0 🆗 yamllint 0m 0s yamllint was not available.
+1 💚 @author 0m 1s The patch does not contain any @author tags.
_ trunk Compile Tests _
+1 💚 shadedclient 30m 7s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 shadedclient 26m 35s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 asflicense 0m 36s The patch does not generate ASF License warnings.
59m 59s
Subsystem Report/Notes
Docker ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/5/artifact/out/Dockerfile
GITHUB PR #8428
Optional Tests dupname asflicense codespell detsecrets yamllint
uname Linux bd09b098a721 5.15.0-173-generic #183-Ubuntu SMP Fri Mar 6 13:29:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / ae91144
Max. process+thread count 612 (vs. ulimit of 10000)
modules C: . U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/5/console
versions git=2.43.0 maven=3.9.11
Powered by Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

Comment thread .github/workflows/codeql.yml
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
permissions:
# required for all workflows
security-events: write
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, it works in your forked repo, as you are the owner of that repo. but are you sure we are granted sufficient permission to enable it in apache/hadoop repo? I didn't find this option, which is mentioned by https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning

Image

@hadoop-yetus
Copy link
Copy Markdown

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 1m 0s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 0s codespell was not available.
+0 🆗 detsecrets 0m 0s detect-secrets was not available.
+0 🆗 yamllint 0m 0s yamllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ trunk Compile Tests _
+1 💚 shadedclient 31m 31s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 shadedclient 26m 51s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 asflicense 0m 35s The patch does not generate ASF License warnings.
61m 28s
Subsystem Report/Notes
Docker ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/7/artifact/out/Dockerfile
GITHUB PR #8428
Optional Tests dupname asflicense codespell detsecrets yamllint
uname Linux 221b45809224 5.15.0-173-generic #183-Ubuntu SMP Fri Mar 6 13:29:34 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / 82afda8
Max. process+thread count 632 (vs. ulimit of 10000)
modules C: . U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/7/console
versions git=2.43.0 maven=3.9.11
Powered by Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

@hadoop-yetus
Copy link
Copy Markdown

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 19m 9s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 0s No case conflicting files found.
+0 🆗 codespell 0m 0s codespell was not available.
+0 🆗 detsecrets 0m 0s detect-secrets was not available.
+0 🆗 yamllint 0m 0s yamllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ trunk Compile Tests _
+1 💚 shadedclient 36m 58s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 shadedclient 32m 50s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 asflicense 0m 35s The patch does not generate ASF License warnings.
91m 7s
Subsystem Report/Notes
Docker ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/8/artifact/out/Dockerfile
GITHUB PR #8428
Optional Tests dupname asflicense codespell detsecrets yamllint
uname Linux e0b495f22052 5.15.0-174-generic #184-Ubuntu SMP Fri Mar 13 18:41:50 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / a8023b6
Max. process+thread count 585 (vs. ulimit of 10000)
modules C: . U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/8/console
versions git=2.43.0 maven=3.9.11
Powered by Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

Copy link
Copy Markdown
Member

@pan3793 pan3793 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, only some nits

Comment thread .github/workflows/codeql.yml Outdated
Comment thread .github/workflows/codeql.yml Outdated
Comment thread .github/workflows/codeql.yml Outdated
Co-authored-by: Cheng Pan <pan3793@gmail.com>
@ajfabbri
Copy link
Copy Markdown
Contributor Author

lgtm, only some nits

Thank you @pan3793 . I applied your suggestions. Will merge once CI is green and will create a test PR to ensure it works ok from trunk.

@hadoop-yetus
Copy link
Copy Markdown

🎊 +1 overall

Vote Subsystem Runtime Logfile Comment
+0 🆗 reexec 0m 51s Docker mode activated.
_ Prechecks _
+1 💚 dupname 0m 1s No case conflicting files found.
+0 🆗 codespell 0m 1s codespell was not available.
+0 🆗 detsecrets 0m 1s detect-secrets was not available.
+0 🆗 yamllint 0m 1s yamllint was not available.
+1 💚 @author 0m 0s The patch does not contain any @author tags.
_ trunk Compile Tests _
+1 💚 shadedclient 38m 58s branch has no errors when building and testing our client artifacts.
_ Patch Compile Tests _
+1 💚 blanks 0m 0s The patch has no blanks issues.
+1 💚 shadedclient 33m 5s patch has no errors when building and testing our client artifacts.
_ Other Tests _
+1 💚 asflicense 0m 36s The patch does not generate ASF License warnings.
75m 2s
Subsystem Report/Notes
Docker ClientAPI=1.54 ServerAPI=1.54 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/9/artifact/out/Dockerfile
GITHUB PR #8428
Optional Tests dupname asflicense codespell detsecrets yamllint
uname Linux d12f0ce65b24 5.15.0-174-generic #184-Ubuntu SMP Fri Mar 13 18:41:50 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
Build tool maven
Personality dev-support/bin/hadoop.sh
git revision trunk / 0094f97
Max. process+thread count 570 (vs. ulimit of 10000)
modules C: . U: .
Console output https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-8428/9/console
versions git=2.43.0 maven=3.9.11
Powered by Apache Yetus 0.14.1 https://yetus.apache.org

This message was automatically generated.

@ajfabbri ajfabbri merged commit 2887364 into apache:trunk Apr 21, 2026
6 checks passed
@ajfabbri ajfabbri deleted the af/codeql-ci branch April 21, 2026 18:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants