Skip to content

MNT Add code scanning workflow #28312

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Feb 2, 2024
Merged

MNT Add code scanning workflow #28312

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
682abe3
MNT Add code scanning workflow
lesteve Jan 30, 2024
b79a30b
Tweak
lesteve Jan 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 73 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
name: "CodeQL"

on:
push:
branches: [ "main", "*.X" ]
pull_request:
branches: [ "main", "*.X" ]
schedule:
- cron: '0 6 * * 1'

jobs:
analyze:
name: Analyze
# Runner size impacts CodeQL analysis time. To learn more, please see:
# - https://gh.io/recommended-hardware-resources-for-running-codeql
# - https://gh.io/supported-runners-and-hardware-resources
# - https://gh.io/using-larger-runners
# Consider using larger runners for possible analysis time improvements.
runs-on: 'ubuntu-latest'
timeout-minutes: 360
permissions:
# required for all workflows
security-events: write

# only required for workflows in private repositories
actions: read
contents: read

strategy:
fail-fast: false
matrix:
language: [ 'javascript-typescript', 'python' ]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was trying to understand if this line means that the workflow will scan JS and Python code only?

I am somewhat interested about getting reports about our Python code, but also somewhat not excited because I assume it'll lead to false positives and "yes I know you think this is dangerous but we are adults and want to do it".

What I would be very excited about is something that vets/scans/checks the workflows and CI configs. At least I think this is where you could manage to sneak things past us or we just misconfigure things to make life easier for attackers. Do you know if something like this exists? (I think it doesn't :()

Copy link
Member Author

@lesteve lesteve Jan 31, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I don't understand the reason why, but I think javascript-typescript actually also checks CI workflows ... see for example the PR in my fork I linked above lesteve#31 where malicious workflows are detected in a PR and also this Github blog post:

The CodeQL workflow scanning queries are (currently) only included in the query suite for JavaScript [...] If the main programming language of your project is something else, such as Python then you need to [...] add JavaScript as an additional language

I agree with you on the Python code, for example I never found LGTM very useful when it was enabled ... and I would admit that my tolerance to false positives is quite low.

The fact that there is no security report on the Python code (tested on my fork) is a good sign for me that there will not be that many false positives. We can always disable python code scanning if we agree it is too much on the noisy side.

Also I haven't played too much with the security report but it looks like you can tag a defect as false positive, hopefully that means that it never shows up again, see this for more details.

# CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
# Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
# Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

steps:
- name: Checkout repository
uses: actions/checkout@v4

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.

# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
# queries: security-extended,security-and-quality


# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@v3

# ℹ️ Command-line programs to run using the OS shell.
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun

# If the Autobuild fails above, remove it and uncomment the following three lines.
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.

# - run: |
# echo "Run, Build Application using script"
# ./location_of_script_within_repo/buildscript.sh

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: "/language:${{matrix.language}}"