Add codeql workflow - #1685
Conversation
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that runs CodeQL for Go on ChangesCodeQL analysis workflow
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 44-45: Update the actions/checkout step in the CodeQL workflow to
set persist-credentials to false. Keep the existing checkout action version and
workflow behavior unchanged, ensuring repository-controlled make commands cannot
access a persisted authentication token.
- Around line 26-34: Update the CodeQL job’s permissions block under analyze to
explicitly include contents: read and actions: read alongside the existing
security-events: write and packages: read permissions, preserving repository
checkout access.
- Around line 52-53: Update both the github/codeql-action references in the
CodeQL workflow, including Initialize CodeQL and the corresponding analyze step,
to pin version v4.37.3 to SHA e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5d6d5639-fc91-40b5-b1e3-aca81146cc9a
📒 Files selected for processing (1)
.github/workflows/codeql.yml
| - name: Checkout repository | ||
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/codeql.yml ]; then
nl -ba .github/workflows/codeql.yml | sed -n '1,140p'
else
echo "missing .github/workflows/codeql.yml"
fi
echo
echo "== all actions/checkout inputs (if any) =="
rg -n "uses:\s*actions/checkout@|persist-credentials|make\s+|github_token|GITHUB_TOKEN" .github/workflows/codeql.yml .github/workflows 2>/dev/null || true
echo
echo "== deterministic default check from available README text in repo =="
rg -n "persist-credentials|persist credentials|defaults:" README.md **/README.md 2>/dev/null || trueRepository: devfile/devworkspace-operator
Length of output: 230
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/codeql.yml ]; then
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/codeql.yml | sed -n '1,140p'
else
echo "missing .github/workflows/codeql.yml"
fi
echo
echo "== actions/checkout and credential-related references =="
grep -RInE "actions/checkout@|persist-credentials|make[[:space:]]+|github_token|GITHUB_TOKEN|permissions:" .github/workflows/codeql.yml .github/workflows 2>/dev/null || true
echo
echo "== workflow files matching codeql =="
find .github/workflows -maxdepth 1 -type f | sort | xargs grep -l "codeql\|actions/checkout" 2>/dev/null || true
echo
echo "== lockfiles mentioning actions checkout =="
for f in action.lock actions.lock actionlint.yml .github/actionlint.yaml; do
[ -f "$f" ] && { echo "--- $f"; grep -n "actions/checkout" "$f" || true; }
doneRepository: devfile/devworkspace-operator
Length of output: 6115
🌐 Web query:
actions/checkout v4 README persist-credentials default README.md
💡 Result:
In actions/checkout v4, the persist-credentials input defaults to true [1][2][3]. This setting configures the authentication token or SSH key in the local git configuration, enabling your subsequent workflow steps to run authenticated git commands [1][2][4]. The token is automatically removed during the post-job cleanup [1][4]. To prevent the credentials from being persisted in the local git configuration, you must explicitly set persist-credentials: false in your workflow step [1][4]. While there have been discussions and proposals regarding changing this default to false to improve security, it remains true in the v4 release series [5].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/README.md
- 2: https://github.com/actions/checkout/blob/v4/action.yml
- 3: https://github.com/actions/checkout/blob/v4.1.1/action.yml
- 4: https://github.com/actions/checkout/tree/v4.3.1
- 5: Change the default value of persist-credentials to false actions/checkout#1687
🌐 Web query:
GitHub security actions checkout persist-credentials pull requests default token
💡 Result:
The persist-credentials input for the actions/checkout GitHub Action controls whether the repository's authentication token (typically GITHUB_TOKEN) is configured in the local Git configuration [1][2]. Key details regarding this setting include: Default Behavior: The default value for persist-credentials is true [1][2]. When enabled, the action configures the Git environment to allow subsequent steps in the same job to execute authenticated Git commands (such as git fetch, git pull, or git push) automatically [1][2]. Security Context: - Risk: When set to true (the default), any step within the same job can potentially access the persisted token [3]. This has historically been a concern for security-sensitive workflows, as it can allow unauthorized access if a job is compromised [4][3]. - Mitigation: To enhance security, users are recommended to set persist-credentials to false if the workflow does not require authenticated Git commands in subsequent steps [3][1]. - Recent Improvements: As of version v6 of actions/checkout, credential storage has been improved by moving the persisted credentials to a separate file under $RUNNER_TEMP rather than directly in the repository's.git/config [2][5]. This change was intended to mitigate risks associated with direct exposure of the token in the Git configuration [6][5]. Despite community discussions and pull requests proposing to change the default value to false to improve security posture, the default has remained true in the official actions/checkout action as of July 2026 [7][4]. Users concerned about security are advised to explicitly configure persist-credentials: false in their workflow YAML files when the functionality is not explicitly required [3][1].
Citations:
- 1: https://github.com/marketplace/actions/checkout
- 2: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 3: Remove
persist-credentialsor change the default tofalseactions/checkout#485 - 4: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312 - 5: actions/checkout@v5.0.1...v6.0.0
- 6: Persist creds to a separate file actions/checkout#2286
- 7: Change the default value of persist-credentials to false actions/checkout#1687
Disable checkout credential persistence.
actions/checkout defaults persist-credentials to true, and this workflow runs repository-controlled make commands after checkout while keeping job-level read-all permissions. Since there’s no authenticated Git usage in this job, set persist-credentials: false so the persisted token cannot be accessed.
Proposed fix
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - name: Checkout repository | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 44-45: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 44 - 45, Update the
actions/checkout step in the CodeQL workflow to set persist-credentials to
false. Keep the existing checkout action version and workflow behavior
unchanged, ensuring repository-controlled make commands cannot access a
persisted authentication token.
Sources: MCP tools, Linters/SAST tools
Signed-off-by: David Kwon <dakwon@redhat.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Signed-off-by: David Kwon <dakwon@redhat.com>
Signed-off-by: David Kwon <dakwon@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/codeql.yml (1)
45-46:⚠️ Potential issue | 🟠 MajorDisable checkout credential persistence.
actions/checkoutpersistsGITHUB_TOKENby default, and the subsequent repository-controlledmakecommands can access it. No later step requires authenticated Git operations, so setpersist-credentials: false.Proposed fix
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/codeql.yml around lines 45 - 46, Update the actions/checkout step in the CodeQL workflow to set persist-credentials to false, ensuring subsequent repository-controlled make commands cannot access the persisted GITHUB_TOKEN.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 26-35: Update the job-level permissions block for the analyze job
to include contents: read and actions: read alongside the existing
security-events: write and packages: read permissions, preserving the required
CodeQL access.
---
Duplicate comments:
In @.github/workflows/codeql.yml:
- Around line 45-46: Update the actions/checkout step in the CodeQL workflow to
set persist-credentials to false, ensuring subsequent repository-controlled make
commands cannot access the persisted GITHUB_TOKEN.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5c5c355a-6a0a-4c44-a460-c185b533e997
📒 Files selected for processing (1)
.github/workflows/codeql.yml
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze (${{ matrix.language }}) | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| security-events: write | ||
| packages: read |
There was a problem hiding this comment.
Restore the CodeQL job’s repository read permissions.
The job-level permissions block overrides the top-level block, so contents: read is currently lost. This can prevent actions/checkout and CodeQL from reading the repository. Add contents: read and actions: read to the job permissions.
Proposed fix
permissions:
+ actions: read
+ contents: read
security-events: write
packages: read🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 26 - 35, Update the job-level
permissions block for the analyze job to include contents: read and actions:
read alongside the existing security-events: write and packages: read
permissions, preserving the required CodeQL access.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dkwon17, rohanKanojia The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
What does this PR do?
Adds CodeQL PR check and weekly scan on Monday morning (7:15 UTC).
What issues does this PR fix or reference?
Part of https://github.com/ambient-code/agentready suggestions.
Is it tested? How?
PR Checklist
/test v8-devworkspace-operator-e2e, v8-che-happy-pathto trigger)v8-devworkspace-operator-e2e: DevWorkspace e2e testv8-che-happy-path: Happy path for verification integration with CheSummary by CodeRabbit