feat(security): add CodeQL composites and integrate into pr-security-scan - #162
Merged
Conversation
WalkthroughAdds four new composite GitHub Actions for CodeQL (config generator, init, analyze, reporter), documentation READMEs for each, and a Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
github-actions
Bot
added
workflow
Contributor
🔍 Lint Analysis
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/self-codeql.yml:
- Around line 22-45: Replace the embedded CodeQL job logic in self-codeql.yml
(the "analyze" job with its runs-on, strategy/matrix and step list including
"Perform CodeQL Analysis") with a single delegation to the repository's reusable
CodeQL workflow: remove the job-level business logic (runs-on, matrix, and
steps) and instead add a job that calls the reusable workflow using uses: with
required inputs/parameters (e.g., language/category) so this self-* entrypoint
only invokes the reusable workflow and does not contain analysis steps itself.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: b5d4914c-c979-4674-84ef-a40df3216660
📒 Files selected for processing (1)
.github/workflows/self-codeql.yml
bedatty
dismissed
coderabbitai[bot]’s stale review
March 23, 2026 17:58
All comments addressed — single suggestion dismissed as not applicable (no reusable CodeQL workflow exists, and creating one for a 3-step self-CI would be over-engineering).
Extract init and analyze steps into reusable composite actions under src/security/. Remove schedule trigger (moving to future schedule-job), remove unnecessary matrix strategy, and add YAML path filters. New composites: - src/security/codeql-init — initializes CodeQL with security-extended suite - src/security/codeql-analyze — performs analysis and uploads SARIF results
bedatty
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/security/codeql-analyze/README.md`:
- Around line 36-42: The permissions YAML in the README's "Permissions required"
section is missing actions: read; update the permissions block (the YAML under
the "Permissions required" header) to include actions: read alongside contents:
read and security-events: write so it matches the codeql-init README and
supports private repos/workflow calls.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 17f4502a-4325-487f-8f89-9c9660fef06b
📒 Files selected for processing (5)
.github/workflows/self-codeql.ymlsrc/security/codeql-analyze/README.mdsrc/security/codeql-analyze/action.ymlsrc/security/codeql-init/README.mdsrc/security/codeql-init/action.yml
…gger Reuse existing changed-workflows composite for file detection instead of inline git diff. CodeQL analysis now only runs when action/workflow YAML files are changed in PRs. Full repo scan will move to a future schedule-job.
lerian-studio
added
size/M
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/self-codeql.yml:
- Around line 8-10: The workflow currently includes the glob pattern '**.yaml'
under the paths filter which violates the repo convention of using only .yml for
workflows; remove the '**.yaml' entry from the paths list in the self-codeql.yml
workflow so only '**.yml' remains (i.e., update the paths array and delete the
'**.yaml' pattern) to enforce the .yml-only policy.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 47f8c38a-5407-448e-bae7-3a8f8b10e331
📒 Files selected for processing (1)
.github/workflows/self-codeql.yml
Align codeql-analyze README permissions with codeql-init for consistency, since both composites are used together.
bedatty
dismissed stale reviews from coderabbitai[bot] and coderabbitai[bot]
March 24, 2026 12:14
All comments addressed — actions:read added to codeql-analyze README.
lerian-studio
added
size/M
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/security/codeql-analyze/README.md`:
- Line 8: Update the composite action README description to explicitly state
that this composite wraps the marketplace action github/codeql-action/analyze;
in the README header/first paragraph (the existing sentence describing the
composite), add a short clause like "this composite wraps
github/codeql-action/analyze" and optionally a one-line note about why
(transparency and abstraction), so readers know which upstream action is being
invoked by the codeql-analyze composite.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d6044653-0803-4d20-a023-6a0dab0fc39c
📒 Files selected for processing (1)
src/security/codeql-analyze/README.md
Add references to github/codeql-action/init and github/codeql-action/analyze in composite README descriptions for transparency.
lerian-studio
added
size/M
lerian-studio
added
size/L
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/security/codeql-reporter/action.yml`:
- Around line 118-120: The catch block currently sets sarifAvailable = false on
any single SARIF parse error which suppresses other readable SARIF findings;
instead, stop flipping the global sarifAvailable flag in the catch, introduce a
separate boolean (e.g., hadParseErrors) and increment a parse-error counter
inside the catch, and only set sarifAvailable based on whether at least one
SARIF file was successfully parsed (e.g., set sarifAvailable = true when parse
succeeds in the parsing code path). Update the final gating logic that uses
has_findings and findings_count to also check hadParseErrors and either fail the
action on mixed results (hadParseErrors && findings_count > 0) or clearly
surface parse errors while still honoring readable findings; apply the same
change to both catch sites handling SARIF parsing.
- Around line 20-23: The output name is using a dash variant "has-findings"
while the composite internals use "has_findings"; rename the published output to
follow the repo convention by changing outputs.has-findings to
outputs.has_findings and ensure its value uses the string 'true' or 'false'
(i.e., set value to ${{ steps.parse-outputs.outputs.has_findings }} but
guarantee the upstream step/parse-outputs emits 'true'/'false' strings so the
action boundary exposes has_findings as the boolean-style string output).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7ea5fe3b-2ff4-4459-a81c-4d2cc44b7087
📒 Files selected for processing (1)
src/security/codeql-reporter/action.yml
Track parse errors independently so a corrupt SARIF file does not suppress findings from other valid SARIF files. Only show the unavailable warning when no SARIF directory or files exist at all.
lerian-studio
added
size/L
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/security/codeql-reporter/action.yml`:
- Around line 135-141: Update the SARIF-report message construction so that when
hadParseErrors is true AND findings.length > 0 you still append a warning about
incomplete results; specifically, inside the same conditional block that builds
the body (the code referencing sarifAvailable, hadParseErrors, findings and the
body string), add a branch or an extra append that inserts a warning line
(similar text to the existing parse-error messages) whenever hadParseErrors &&
findings.length > 0 so users see that some SARIF files failed to parse even
though findings were recovered.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 56d009ec-bb88-48ce-ac96-4a45b8ca8858
📒 Files selected for processing (1)
src/security/codeql-reporter/action.yml
Remove CodeQL integration from pr-security-scan.yml — will be added in a separate PR with proper planning for external consumers.
github-actions
Bot
removed
the
security
lerian-studio
added
size/L
The dirname extraction was causing CodeQL to scan entire directories (e.g., all of .github/workflows/) instead of only the changed files. Now uses exact file paths in the config, ensuring CodeQL only analyzes the specific files that were modified in the PR.
lerian-studio
added
size/L
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/security/codeql-config/action.yml`:
- Around line 12-15: The declared action input "path-mode" is unused: either
remove the input declaration "path-mode" and its corresponding env export
"PATH_MODE" in the env block, or implement logic that consumes PATH_MODE in the
action script to switch between file-based and dir-based changed-path
interpretation; locate the "path-mode" input in the inputs section and the
"PATH_MODE" env assignment in the env block and either delete both or wire
PATH_MODE into the changed-paths handling code so the script checks PATH_MODE
=== "dirs" to treat paths as directories and "files" for exact-file matching.
- Around line 21-23: Rename the boolean output currently named "skip" to follow
the has_<noun> convention and invert its semantics: change the output key "skip"
to "has-paths" (so it is 'true' when paths exist, 'false' when empty) and update
any producers/consumers accordingly; update the action output definition that
references steps.generate.outputs.skip to steps.generate.outputs.has-paths and
adjust any callers (e.g. replace checks like if: steps.config.outputs.skip !=
'true' with if: steps.config.outputs.has-paths == 'true') so all logic now uses
the new "has-paths" output with inverted truth value.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d63eb9f2-336f-4d81-9fd0-b3b899894928
📒 Files selected for processing (1)
src/security/codeql-config/action.yml
Pre-filter the Security tab URL with pr:<number>+is:open so the link opens directly to the findings for the current PR.
lerian-studio
added
size/L
… input Add warning in codeql-reporter when findings exist but some SARIF files failed to parse. Remove unused path-mode input and PATH_MODE env var from codeql-config (became dead code after dirname removal).
bedatty
dismissed stale reviews from coderabbitai[bot] and coderabbitai[bot]
March 24, 2026 17:04
All comments addressed.
lerian-studio
added
size/L
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/security/codeql-config/action.yml`:
- Around line 33-37: The skip branch that sets "skip=true" when PATHS is empty
leaves the "config-file" output unset; modify the skip branches (the block
checking [ -z "$PATHS" ] and the similar block around lines 42-45) to also emit
an explicit empty "config-file" output so outputs remain deterministic (i.e.,
write a "config-file=" entry to GITHUB_OUTPUT alongside "skip=true" before
exiting).
In `@src/security/codeql-config/README.md`:
- Line 31: Replace the floating action tag "uses:
LerianStudio/github-actions-shared-workflows/src/security/codeql-config@v1.x.x"
with a concrete release tag or an explicit testing branch as required by policy;
update both occurrences (the exact string "uses:
LerianStudio/github-actions-shared-workflows/src/security/codeql-config@v1.x.x")
to either a pinned release like "@vX.Y.Z" for production docs or
"@develop"/"@feat/<branch>" for testing examples so the README examples comply
with the repository tagging guidelines.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9c04dd40-85ae-442f-8455-b9846bd22873
📒 Files selected for processing (3)
src/security/codeql-config/README.mdsrc/security/codeql-config/action.ymlsrc/security/codeql-reporter/action.yml
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions Shared Workflows
Description
Adds CodeQL static analysis as reusable composites and integrates it into the security scanning pipeline.
New composites:
src/security/codeql-init— wrapsgithub/codeql-action/initwithsecurity-extendedsuite by defaultsrc/security/codeql-analyze— wrapsgithub/codeql-action/analyzeand uploads SARIF resultssrc/security/codeql-reporter— reads CodeQL SARIF output and posts formatted findings as PR commentsWorkflow changes:
pr-security-scan.yml— new optional inputs (enable_codeql,codeql_languages,codeql_queries) that add a parallel CodeQL analysis job. External repos can enable withenable_codeql: trueand pass their languageself-pr-validation.yml— added CodeQL job for this repo (language:actions), running alongside existing lintersUsage by external repos:
Type of Change
feat: New workflow or new input/output/step in an existing workflowfix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)perf: Performance improvement (e.g. caching, parallelism, reduced steps)refactor: Internal restructuring with no behavior changedocs: Documentation only (README, docs/, inline comments)ci: Changes to self-CI (workflows under.github/workflows/that run on this repo)chore: Dependency bumps, config updates, maintenancetest: Adding or updating testsBREAKING CHANGE: Callers must update their configuration after this PRBreaking Changes
None. CodeQL is opt-in via
enable_codeql: false(default).Testing
@developor the beta tagCaller repo / workflow run: N/A — self-CI will validate on this PR; external repos unaffected (opt-in)
Related Issues
Closes #
Summary by CodeRabbit
New Features
Documentation