Enable CodeQL scan for GitHub Actions #1821
Conversation
Update the CI configuration to run CodeQL on GitHub Actions in addition to JavaScript. This uses a matrix as suggested in the description of the "languages" input for the `github/codeql-action/init` action.
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
.github/workflows/checks.yml
Outdated
| with: | ||
| config-file: ./.github/codeql.yml | ||
| languages: javascript | ||
| # config-file: ./.github/codeql.yml |
There was a problem hiding this comment.
This job currently fails if this line is enabled because the configuration is not valid if matrix.what == 'actions', but we want the configuration for matrix.what == 'javascript'...
There was a problem hiding this comment.
The reason for this is this line:
Line 6 in 7b57255
which it complained about here.
This has been reported at github/codeql-action#2658
|
So this is producing 50 findings for GitHub Actions, 49 of which are for "Unversioned Immutable Action" and 1 is "Workflow Should Use Default Setup". The latter is telling us to use the default CodeQL setup which is neither correct (because we don't for the JavaScript scan) nor useful imho (I want it enabled explicitly in code, no matter what GitHub prefers) - but it can be ignored I suppose. The former is a bit confusing to me. As far as I know immutable actions are not out yet and the description of the suggestion is a bit of a mess, not to mention seemingly confusing commit refs for tags. Also, both links the description contains are invalid... I opened an issue about this at github/codeql-action#2659. |
|
Per the linked thread, this is currently blocked by the presence of the "Unversioned Immutable Action" findings which are not intended for public consumption just yet. |
Relates to #134, #1114, #1751
Summary
Update the CI configuration to run CodeQL on GitHub Actions in addition to JavaScript. This uses a matrix as suggested in the description of the "languages" input for the
github/codeql-action/initaction.Based on https://github.blog/changelog/2024-12-17-find-and-fix-actions-workflows-vulnerabilities-with-codeql-public-preview/