ci(PRODSEC-343): consolidate CodeQL workflows into single unified scan - #2
Closed
anguprasad07 wants to merge 3 commits into
Closed
ci(PRODSEC-343): consolidate CodeQL workflows into single unified scan#2anguprasad07 wants to merge 3 commits into
anguprasad07 wants to merge 3 commits into
Conversation
…n - codeql-full-scan.yml
…n - codeql-pr-scan.yml
There was a problem hiding this comment.
Pull request overview
This PR intends to consolidate CodeQL scanning by introducing a unified .github/workflows/codeql.yml workflow that covers scheduled, manual, and PR-triggered scans via a reusable workflow.
Findings (ordered by severity)
- Blocker
- Duplicate CodeQL executions: the PR adds a unified workflow and also adds/keeps separate PR/full scan workflows, which will cause overlapping scheduled and PR runs. (See:
.github/workflows/codeql.yml,.github/workflows/codeql-pr-scan.yml,.github/workflows/codeql-full-scan.yml)
- Duplicate CodeQL executions: the PR adds a unified workflow and also adds/keeps separate PR/full scan workflows, which will cause overlapping scheduled and PR runs. (See:
- Medium
- Repo convention mismatch:
pull_requestbranch filtering is commented out incodeql.yml, while other workflows in this repo restrict PR triggers tobranches: [main]. (See:.github/workflows/codeql.yml:12-14) - Supply-chain/reproducibility risk: reusable workflow is referenced via a moving ref
@masterinstead of an immutable tag/SHA. (See:.github/workflows/codeql.yml:26)
- Repo convention mismatch:
Changes:
- Add unified CodeQL workflow (
codeql.yml) combining schedule, workflow_dispatch, and PR scanning with PR-only concurrency cancellation. - Add PR-only CodeQL workflow (
codeql-pr-scan.yml) using a separate reusable workflow. - Add scheduled/dispatch full CodeQL workflow (
codeql-full-scan.yml) using a separate reusable workflow.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| .github/workflows/codeql.yml | Introduces unified CodeQL workflow with schedule/dispatch/PR triggers and caching/concurrency controls. |
| .github/workflows/codeql-pr-scan.yml | Adds a separate PR-only CodeQL workflow (overlaps with unified workflow). |
| .github/workflows/codeql-full-scan.yml | Adds a separate scheduled/dispatch CodeQL workflow (overlaps with unified workflow). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1
to
+5
| name: "CodeQL" | ||
|
|
||
| on: | ||
| schedule: | ||
| - cron: '0 1 * * *' # Daily at 01:00 UTC |
| default: '' | ||
| pull_request: | ||
| types: [opened, reopened, ready_for_review, synchronize] | ||
| # branches: [master, main] |
| # Skip draft PRs. Non-PR events are never drafts so this guard is a no-op | ||
| # for schedule/workflow_dispatch. | ||
| if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }} | ||
| uses: KeepTruckin/security-scanners/.github/workflows/codeql-scan.yml@master |
Comment on lines
+1
to
+6
| name: "CodeQL PR Scan" | ||
|
|
||
| on: | ||
| pull_request: | ||
| types: [opened, reopened, ready_for_review, synchronize] | ||
| # branches: [master, main] |
Comment on lines
+1
to
+6
| name: "CodeQL Full Scan" | ||
|
|
||
| on: | ||
| schedule: | ||
| - cron: '0 1 * * *' # Daily at 01:00 UTC — adjust as needed | ||
| workflow_dispatch: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces separate codeql-full-scan.yml and codeql-pr-scan.yml with a single unified codeql.yml workflow.