Add codeql workflow - #1685
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dkwon17 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Warning Review limit reached
Next review available in: 47 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that runs weekly and on ChangesCodeQL analysis workflow
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 44-45: Update the actions/checkout step in the CodeQL workflow to
set persist-credentials to false. Keep the existing checkout action version and
workflow behavior unchanged, ensuring repository-controlled make commands cannot
access a persisted authentication token.
- Around line 26-34: Update the CodeQL job’s permissions block under analyze to
explicitly include contents: read and actions: read alongside the existing
security-events: write and packages: read permissions, preserving repository
checkout access.
- Around line 52-53: Update both the github/codeql-action references in the
CodeQL workflow, including Initialize CodeQL and the corresponding analyze step,
to pin version v4.37.3 to SHA e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5d6d5639-fc91-40b5-b1e3-aca81146cc9a
📒 Files selected for processing (1)
.github/workflows/codeql.yml
| - name: Checkout repository | ||
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/codeql.yml ]; then
nl -ba .github/workflows/codeql.yml | sed -n '1,140p'
else
echo "missing .github/workflows/codeql.yml"
fi
echo
echo "== all actions/checkout inputs (if any) =="
rg -n "uses:\s*actions/checkout@|persist-credentials|make\s+|github_token|GITHUB_TOKEN" .github/workflows/codeql.yml .github/workflows 2>/dev/null || true
echo
echo "== deterministic default check from available README text in repo =="
rg -n "persist-credentials|persist credentials|defaults:" README.md **/README.md 2>/dev/null || trueRepository: devfile/devworkspace-operator
Length of output: 230
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/codeql.yml ]; then
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/codeql.yml | sed -n '1,140p'
else
echo "missing .github/workflows/codeql.yml"
fi
echo
echo "== actions/checkout and credential-related references =="
grep -RInE "actions/checkout@|persist-credentials|make[[:space:]]+|github_token|GITHUB_TOKEN|permissions:" .github/workflows/codeql.yml .github/workflows 2>/dev/null || true
echo
echo "== workflow files matching codeql =="
find .github/workflows -maxdepth 1 -type f | sort | xargs grep -l "codeql\|actions/checkout" 2>/dev/null || true
echo
echo "== lockfiles mentioning actions checkout =="
for f in action.lock actions.lock actionlint.yml .github/actionlint.yaml; do
[ -f "$f" ] && { echo "--- $f"; grep -n "actions/checkout" "$f" || true; }
doneRepository: devfile/devworkspace-operator
Length of output: 6115
🌐 Web query:
actions/checkout v4 README persist-credentials default README.md
💡 Result:
In actions/checkout v4, the persist-credentials input defaults to true [1][2][3]. This setting configures the authentication token or SSH key in the local git configuration, enabling your subsequent workflow steps to run authenticated git commands [1][2][4]. The token is automatically removed during the post-job cleanup [1][4]. To prevent the credentials from being persisted in the local git configuration, you must explicitly set persist-credentials: false in your workflow step [1][4]. While there have been discussions and proposals regarding changing this default to false to improve security, it remains true in the v4 release series [5].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/README.md
- 2: https://github.com/actions/checkout/blob/v4/action.yml
- 3: https://github.com/actions/checkout/blob/v4.1.1/action.yml
- 4: https://github.com/actions/checkout/tree/v4.3.1
- 5: Change the default value of persist-credentials to false actions/checkout#1687
🌐 Web query:
GitHub security actions checkout persist-credentials pull requests default token
💡 Result:
The persist-credentials input for the actions/checkout GitHub Action controls whether the repository's authentication token (typically GITHUB_TOKEN) is configured in the local Git configuration [1][2]. Key details regarding this setting include: Default Behavior: The default value for persist-credentials is true [1][2]. When enabled, the action configures the Git environment to allow subsequent steps in the same job to execute authenticated Git commands (such as git fetch, git pull, or git push) automatically [1][2]. Security Context: - Risk: When set to true (the default), any step within the same job can potentially access the persisted token [3]. This has historically been a concern for security-sensitive workflows, as it can allow unauthorized access if a job is compromised [4][3]. - Mitigation: To enhance security, users are recommended to set persist-credentials to false if the workflow does not require authenticated Git commands in subsequent steps [3][1]. - Recent Improvements: As of version v6 of actions/checkout, credential storage has been improved by moving the persisted credentials to a separate file under $RUNNER_TEMP rather than directly in the repository's.git/config [2][5]. This change was intended to mitigate risks associated with direct exposure of the token in the Git configuration [6][5]. Despite community discussions and pull requests proposing to change the default value to false to improve security posture, the default has remained true in the official actions/checkout action as of July 2026 [7][4]. Users concerned about security are advised to explicitly configure persist-credentials: false in their workflow YAML files when the functionality is not explicitly required [3][1].
Citations:
- 1: https://github.com/marketplace/actions/checkout
- 2: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 3: Remove
persist-credentialsor change the default tofalseactions/checkout#485 - 4: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312 - 5: actions/checkout@v5.0.1...v6.0.0
- 6: Persist creds to a separate file actions/checkout#2286
- 7: Change the default value of persist-credentials to false actions/checkout#1687
Disable checkout credential persistence.
actions/checkout defaults persist-credentials to true, and this workflow runs repository-controlled make commands after checkout while keeping job-level read-all permissions. Since there’s no authenticated Git usage in this job, set persist-credentials: false so the persisted token cannot be accessed.
Proposed fix
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - name: Checkout repository | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 44-45: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 44 - 45, Update the
actions/checkout step in the CodeQL workflow to set persist-credentials to
false. Keep the existing checkout action version and workflow behavior
unchanged, ensuring repository-controlled make commands cannot access a
persisted authentication token.
Sources: MCP tools, Linters/SAST tools
Signed-off-by: David Kwon <dakwon@redhat.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,67 @@ | |||
| # | |||
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Signed-off-by: David Kwon <dakwon@redhat.com>
| - name: Set up Go 1.x | ||
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | ||
| with: | ||
| go-version: 1.26.5 |
There was a problem hiding this comment.
Maybe we should pick from go.mod file ?
| go-version: 1.26.5 | |
| go-version-file: go.mod |
3 participants
What does this PR do?
Adds CodeQL PR check and weekly scan on Monday morning (7:15 UTC).
What issues does this PR fix or reference?
Part of https://github.com/ambient-code/agentready suggestions.
Is it tested? How?
PR Checklist
/test v8-devworkspace-operator-e2e, v8-che-happy-pathto trigger)v8-devworkspace-operator-e2e: DevWorkspace e2e testv8-che-happy-path: Happy path for verification integration with CheSummary by CodeRabbit