Skip to content

Add codeql workflow #1685

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dkwon17 wants to merge 3 commits into
base: main
Choose a base branch
from
+70 −0
Open

Add codeql workflow #1685

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a0ef2d1
Add codeql workflow
dkwon17 Jul 29, 2026
6f9b915
Update commit hash
dkwon17 Jul 29, 2026
b39204a
Add top level permission and retrieve go version from go.mod
dkwon17 Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 70 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
#
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
# Copyright (c) 2019-2026 Red Hat, Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: DevWorkspace Operator CodeQL scan

on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
schedule:
- cron: '15 7 * * 1'

permissions:
contents: read

jobs:
analyze:
name: Analyze (${{ matrix.language }})
runs-on: ubuntu-latest
permissions:
security-events: write
packages: read
Comment on lines +26 to +35

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Restore the CodeQL job’s repository read permissions.

The job-level permissions block overrides the top-level block, so contents: read is currently lost. This can prevent actions/checkout and CodeQL from reading the repository. Add contents: read and actions: read to the job permissions.

Proposed fix 
     permissions:
+      actions: read
+      contents: read
       security-events: write
       packages: read
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml around lines 26 - 35, Update the job-level
permissions block for the analyze job to include contents: read and actions:
read alongside the existing security-events: write and packages: read
permissions, preserving the required CodeQL access.


strategy:
fail-fast: false
matrix:
include:
- language: go
build-mode: manual

steps:
- name: Checkout repository
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
Comment on lines +45 to +46

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt =="
if [ -f .github/workflows/codeql.yml ]; then
  nl -ba .github/workflows/codeql.yml | sed -n '1,140p'
else
  echo "missing .github/workflows/codeql.yml"
fi

echo
echo "== all actions/checkout inputs (if any) =="
rg -n "uses:\s*actions/checkout@|persist-credentials|make\s+|github_token|GITHUB_TOKEN" .github/workflows/codeql.yml .github/workflows 2>/dev/null || true

echo
echo "== deterministic default check from available README text in repo =="
rg -n "persist-credentials|persist credentials|defaults:" README.md **/README.md 2>/dev/null || true

Repository: devfile/devworkspace-operator

Length of output: 230

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt =="
if [ -f .github/workflows/codeql.yml ]; then
  awk '{printf "%6d  %s\n", NR, $0}' .github/workflows/codeql.yml | sed -n '1,140p'
else
  echo "missing .github/workflows/codeql.yml"
fi

echo
echo "== actions/checkout and credential-related references =="
grep -RInE "actions/checkout@|persist-credentials|make[[:space:]]+|github_token|GITHUB_TOKEN|permissions:" .github/workflows/codeql.yml .github/workflows 2>/dev/null || true

echo
echo "== workflow files matching codeql =="
find .github/workflows -maxdepth 1 -type f | sort | xargs grep -l "codeql\|actions/checkout" 2>/dev/null || true

echo
echo "== lockfiles mentioning actions checkout =="
for f in action.lock actions.lock actionlint.yml .github/actionlint.yaml; do
  [ -f "$f" ] && { echo "--- $f"; grep -n "actions/checkout" "$f" || true; }
done

Repository: devfile/devworkspace-operator

Length of output: 6115

🌐 Web query:

actions/checkout v4 README persist-credentials default README.md

💡 Result:

In actions/checkout v4, the persist-credentials input defaults to true [1][2][3]. This setting configures the authentication token or SSH key in the local git configuration, enabling your subsequent workflow steps to run authenticated git commands [1][2][4]. The token is automatically removed during the post-job cleanup [1][4]. To prevent the credentials from being persisted in the local git configuration, you must explicitly set persist-credentials: false in your workflow step [1][4]. While there have been discussions and proposals regarding changing this default to false to improve security, it remains true in the v4 release series [5].

Citations:

🌐 Web query:

GitHub security actions checkout persist-credentials pull requests default token

💡 Result:

The persist-credentials input for the actions/checkout GitHub Action controls whether the repository's authentication token (typically GITHUB_TOKEN) is configured in the local Git configuration [1][2]. Key details regarding this setting include: Default Behavior: The default value for persist-credentials is true [1][2]. When enabled, the action configures the Git environment to allow subsequent steps in the same job to execute authenticated Git commands (such as git fetch, git pull, or git push) automatically [1][2]. Security Context: - Risk: When set to true (the default), any step within the same job can potentially access the persisted token [3]. This has historically been a concern for security-sensitive workflows, as it can allow unauthorized access if a job is compromised [4][3]. - Mitigation: To enhance security, users are recommended to set persist-credentials to false if the workflow does not require authenticated Git commands in subsequent steps [3][1]. - Recent Improvements: As of version v6 of actions/checkout, credential storage has been improved by moving the persisted credentials to a separate file under $RUNNER_TEMP rather than directly in the repository's.git/config [2][5]. This change was intended to mitigate risks associated with direct exposure of the token in the Git configuration [6][5]. Despite community discussions and pull requests proposing to change the default value to false to improve security posture, the default has remained true in the official actions/checkout action as of July 2026 [7][4]. Users concerned about security are advised to explicitly configure persist-credentials: false in their workflow YAML files when the functionality is not explicitly required [3][1].

Citations:

Disable checkout credential persistence.

actions/checkout defaults persist-credentials to true, and this workflow runs repository-controlled make commands after checkout while keeping job-level read-all permissions. Since there’s no authenticated Git usage in this job, set persist-credentials: false so the persisted token cannot be accessed.

Proposed fix 
       uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      with:
+        persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Checkout repository
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- name: Checkout repository
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.28.0)

[warning] 44-45: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml around lines 44 - 45, Update the
actions/checkout step in the CodeQL workflow to set persist-credentials to
false. Keep the existing checkout action version and workflow behavior
unchanged, ensuring repository-controlled make commands cannot access a
persisted authentication token.

Sources: MCP tools, Linters/SAST tools


- name: Set up Go 1.x
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: go.mod

- name: Initialize CodeQL
uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}

- name: Run manual build steps
if: matrix.build-mode == 'manual'
shell: bash
run: |
make manager
make compile-devworkspace-controller
make compile-webhook-server
-
name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
with:
category: "/language:${{matrix.language}}"
Loading