From bac92a0470b7fa3b24aeaea4745ddbc38821d537 Mon Sep 17 00:00:00 2001 From: Leah Restad Date: Tue, 21 Jul 2026 10:37:41 -0700 Subject: [PATCH 1/6] CodeQL configuration file --- .github/workflows/codeql.yml | 9 +-------- CodeQL.yml | 6 ++++++ 2 files changed, 7 insertions(+), 8 deletions(-) create mode 100644 CodeQL.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c7fd1a5..e7bc775 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -65,14 +65,7 @@ jobs: with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - config: | - paths-ignore: - - 'dotnet/FunctionalTests/**' - - 'dotnet/UnitTests/**' - - 'nodejs/tests/**' - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. + config-file: ./CodeQL.yml # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs # queries: security-extended,security-and-quality diff --git a/CodeQL.yml b/CodeQL.yml new file mode 100644 index 0000000..110921d --- /dev/null +++ b/CodeQL.yml @@ -0,0 +1,6 @@ +name: "CodeQL Config" + +paths-ignore: + - "dotnet/UnitTests/**" + - "dotnet/FunctionalTests/**" + - "nodejs/tests/**" From ad4d5f16bb772e336bd61ab62146e7971c3ef109 Mon Sep 17 00:00:00 2001 From: Leah Restad Date: Tue, 21 Jul 2026 10:44:56 -0700 Subject: [PATCH 2/6] Re-simplify CodeQL build --- .github/workflows/codeql.yml | 47 +++--------------------------------- 1 file changed, 3 insertions(+), 44 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e7bc775..15b01d2 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,15 +10,11 @@ on: branches: [ "main" ] schedule: - cron: '18 16 * * 4' + workflow_dispatch: jobs: analyze: name: Analyze (${{ matrix.language }}) - # Runner size impacts CodeQL analysis time. To learn more, please see: - # - https://gh.io/recommended-hardware-resources-for-running-codeql - # - https://gh.io/supported-runners-and-hardware-resources - # - https://gh.io/using-larger-runners (GitHub.com only) - # Consider using larger runners or machines with greater resources for possible analysis time improvements. runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} permissions: # required for all workflows @@ -38,28 +34,14 @@ jobs: - language: actions build-mode: none - language: csharp - build-mode: manual + build-mode: none - language: javascript-typescript build-mode: none - # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' - # Use `c-cpp` to analyze code written in C, C++ or both - # Use 'java-kotlin' to analyze code written in Java, Kotlin or both - # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both - # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, - # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. - # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how - # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages + steps: - name: Checkout repository uses: actions/checkout@v5 - # Add any setup steps before running the `github/codeql-action/init` action. - # This includes steps like installing compilers or runtimes (`actions/setup-node` - # or others). This is typically only required for manual builds. - # - name: Setup runtime (example) - # uses: actions/setup-example@v1 - - # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL uses: github/codeql-action/init@v4 with: @@ -67,29 +49,6 @@ jobs: build-mode: ${{ matrix.build-mode }} config-file: ./CodeQL.yml - # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality - - - name: Setup .NET SDK - if: matrix.language == 'csharp' - uses: actions/setup-dotnet@v5 - with: - dotnet-version: 8.0.x - - # If the analyze step fails for one of the languages you are analyzing with - # "We were unable to automatically build your code", modify the matrix above - # to set the build mode to "manual" for that language. Then modify this step - # to build your code. - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - name: Run manual build steps - if: matrix.build-mode == 'manual' - shell: bash - working-directory: dotnet - run: | - dotnet restore Microsoft.Security.AntiSSRF.sln - dotnet build Microsoft.Security.AntiSSRF.sln --configuration Release --no-restore - - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v4 with: From 648eb5d77039ec46e591e71f3d8ab77cfa5f90b6 Mon Sep 17 00:00:00 2001 From: Leah Restad Date: Tue, 21 Jul 2026 10:46:29 -0700 Subject: [PATCH 3/6] Adjusting permissions --- .github/workflows/codeql.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 15b01d2..3377b84 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -17,14 +17,7 @@ jobs: name: Analyze (${{ matrix.language }}) runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} permissions: - # required for all workflows security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read contents: read strategy: From 4e490aa34dab1fa56d6215e8bae0c0cf08f93514 Mon Sep 17 00:00:00 2001 From: Leah Restad Date: Tue, 21 Jul 2026 10:50:55 -0700 Subject: [PATCH 4/6] License header --- CodeQL.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CodeQL.yml b/CodeQL.yml index 110921d..debf225 100644 --- a/CodeQL.yml +++ b/CodeQL.yml @@ -1,3 +1,6 @@ +# Copyright (c) Microsoft Corporation. +# Licensed under the MIT License. + name: "CodeQL Config" paths-ignore: From dba8f8fe59215b8689b017d6c05f7b0bfb095d99 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 21 Jul 2026 18:03:58 +0000 Subject: [PATCH 5/6] Indent CodeQL workflow steps --- .github/workflows/codeql.yml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3377b84..ffc9e07 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,17 +32,17 @@ jobs: build-mode: none steps: - - name: Checkout repository - uses: actions/checkout@v5 + - name: Checkout repository + uses: actions/checkout@v5 - - name: Initialize CodeQL - uses: github/codeql-action/init@v4 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - config-file: ./CodeQL.yml + - name: Initialize CodeQL + uses: github/codeql-action/init@v4 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + config-file: ./CodeQL.yml - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 - with: - category: "/language:${{matrix.language}}" + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v4 + with: + category: "/language:${{matrix.language}}" From fef054185ca0b07e926eefd824666c1d7381cc4e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 21 Jul 2026 18:05:24 +0000 Subject: [PATCH 6/6] Fix CodeQL matrix indentation --- .github/workflows/codeql.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ffc9e07..5e75b25 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,12 +24,12 @@ jobs: fail-fast: false matrix: include: - - language: actions - build-mode: none - - language: csharp - build-mode: none - - language: javascript-typescript - build-mode: none + - language: actions + build-mode: none + - language: csharp + build-mode: none + - language: javascript-typescript + build-mode: none steps: - name: Checkout repository