CI: run CodeQL #540

Open

smelc wants to merge 1 commit from smelc/smelc/ci-run-codeql into main

smelc commented

2025-05-09 12:41:38 +00:00

(Migrated from github.com)

Context

I am experimenting with GitHub's CodeQL static analyzer and this project is a good target, because it manipulates user input (in URLs).

How to trust this PR

Look at the vulnerabilities found on my fork: https://github.com/smelc/nix-security-tracker/security/code-scanning IMHO most of the reports are good:

By default this check is non intrusive, because this new pipeline only blocks merging when a new error, critical, or high severity is found in code changed by the PR (see corresponding doc). As visible in the image above, all existing alerts are below this treshold.

If we want the check to forbid merging PRs on lower severities it is also possible: https://docs.github.com/en/enterprise-server@3.13/code-security/code-scanning/managing-your-code-scanning-configuration/editing-your-configuration-of-default-setup#defining-the-alert-severities-that-cause-a-check-failure-for-a-pull-request, here (not in the branch protection rule, which is why I'm highlighting it here):

Note that I disabled analyzing src/website/shared/migrations as it seemed to me those files had been generated.

We'll also want to check this in the branch protection settings of the repo:

so that malicious users cannot turn CodeQL off/things don't get green if CodeQL is silent

Maintenance

I will be available to maintain this pipeline in the foreseeable future, so this shouldn't be an additional burden on the team. Maintaining this will be part of my learning path on CodeQL.

## Context I am experimenting with GitHub's [CodeQL](https://codeql.github.com/) static analyzer and this project is a good target, because it manipulates user input (in URLs). ## How to trust this PR Look at the vulnerabilities found on my fork: https://github.com/smelc/nix-security-tracker/security/code-scanning IMHO most of the reports are good: ![image](https://github.com/user-attachments/assets/1e54b0ad-85b4-484a-82e7-d8b9888260d4) By default this check is non intrusive, because this new pipeline only blocks merging when a new _error_, _critical_, or _high_ severity is found in code changed by the PR (see [corresponding doc](https://docs.github.com/en/enterprise-server@3.13/code-security/code-scanning/managing-code-scanning-alerts/triaging-code-scanning-alerts-in-pull-requests#code-scanning-results-check-failures)). As visible in the image above, all existing alerts are below this treshold. If we want the check to forbid merging PRs on lower severities it is also possible: https://docs.github.com/en/enterprise-server@3.13/code-security/code-scanning/managing-your-code-scanning-configuration/editing-your-configuration-of-default-setup#defining-the-alert-severities-that-cause-a-check-failure-for-a-pull-request, here (not in the branch protection rule, which is why I'm highlighting it here): ![image](https://github.com/user-attachments/assets/aa28db2e-462d-4b80-82ca-304eca091d62) Note that I disabled analyzing `src/website/shared/migrations` as it seemed to me those files had been generated. We'll also want to check this in the branch protection settings of the repo: ![image](https://github.com/user-attachments/assets/cbdc9366-a605-4db8-8d7c-f67004972340) so that malicious users cannot turn CodeQL off/things don't get green if CodeQL is silent ## Maintenance I will be available to maintain this pipeline in the foreseeable future, so this shouldn't be an additional burden on the team. Maintaining this will be part of my learning path on CodeQL.

❤️ 1

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin smelc/smelc/ci-run-codeql:smelc/smelc/ci-run-codeql

git switch smelc/smelc/ci-run-codeql

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff smelc/smelc/ci-run-codeql

git switch smelc/smelc/ci-run-codeql

git rebase main

git switch main

git merge --ff-only smelc/smelc/ci-run-codeql

git switch smelc/smelc/ci-run-codeql

git rebase main

git switch main

git merge --no-ff smelc/smelc/ci-run-codeql

git switch main

git merge --squash smelc/smelc/ci-run-codeql