Add CodeQL workflow for security analysis#2
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds a GitHub Actions workflow for CodeQL security analysis to enable automated code scanning for security vulnerabilities. The workflow is configured to run on pushes and pull requests to the main and develop branches, as well as on a weekly schedule.
Changes:
- Added CodeQL workflow configuration for C# security analysis with scheduled scans
| branches: [ "main", "develop" ] | ||
| pull_request: | ||
| branches: [ "main", "develop" ] |
There was a problem hiding this comment.
The workflow lacks the paths-ignore configuration that exists in pr.yaml (lines 16-18). The pr.yaml workflow ignores changes to Markdown files and documentation (**.md and docs/**) to avoid unnecessary workflow runs. Consider adding the same paths-ignore configuration to prevent CodeQL from running when only documentation is updated, which would save CI resources and reduce workflow execution time.
| branches: [ "main", "develop" ] | |
| pull_request: | |
| branches: [ "main", "develop" ] | |
| branches: [ "main", "develop" ] | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| pull_request: | |
| branches: [ "main", "develop" ] | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' |
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: | | ||
| 8.0.x | ||
|
|
||
| - name: Restore dependencies | ||
| run: dotnet restore | ||
|
|
||
| - name: Build | ||
| run: dotnet build --no-restore --configuration Release | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v3 |
There was a problem hiding this comment.
Inconsistent YAML indentation. The steps list items should be indented with 6 spaces to align with the convention used in other workflows in this repository (see pr.yaml line 29, release.yaml line 16, docfx.yaml line 18). Currently, the step items appear to be indented with only 4 spaces, which while syntactically valid, deviates from the established codebase pattern.
There was a problem hiding this comment.
@copilot open a new pull request to apply changes based on this feedback
| name: "CodeQL" | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ "main", "develop" ] | ||
| pull_request: | ||
| branches: [ "main", "develop" ] | ||
| schedule: | ||
| - cron: '30 1 * * 0' # Weekly scan on Sundays | ||
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| actions: read | ||
| contents: read | ||
| security-events: write | ||
|
|
||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| language: [ 'csharp' ] | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: | | ||
| 8.0.x | ||
|
|
||
| - name: Restore dependencies | ||
| run: dotnet restore | ||
|
|
||
| - name: Build | ||
| run: dotnet build --no-restore --configuration Release | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v3 |
There was a problem hiding this comment.
The file is placed in an incorrect directory path. It should be located at .github/workflows/codeql.yml instead of .github/workflows/.github/workflows/codeql.yml. The nested .github/workflows/ structure will prevent GitHub Actions from discovering and running this workflow. Workflow files must be directly in the .github/workflows/ directory to be executed.
| name: "CodeQL" | |
| on: | |
| push: | |
| branches: [ "main", "develop" ] | |
| pull_request: | |
| branches: [ "main", "develop" ] | |
| schedule: | |
| - cron: '30 1 * * 0' # Weekly scan on Sundays | |
| jobs: | |
| analyze: | |
| name: Analyze | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'csharp' ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: | | |
| 8.0.x | |
| - name: Restore dependencies | |
| run: dotnet restore | |
| - name: Build | |
| run: dotnet build --no-restore --configuration Release | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| # This file is intentionally left blank. | |
| # The active CodeQL workflow should be located at: | |
| # .github/workflows/codeql.yml |
Restrict CodeQL workflow to only the 'main' branch for push and pull request events.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
@Chris-Wolfgang I've opened a new pull request, #3, to work on those changes. Once the pull request is ready, I'll request review from you. |
|
@Chris-Wolfgang I've opened a new pull request, #4, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: Chris-Wolfgang <210299580+Chris-Wolfgang@users.noreply.github.com>
Co-authored-by: Chris-Wolfgang <210299580+Chris-Wolfgang@users.noreply.github.com>
Fix YAML indentation in CodeQL workflow to match repository convention
|
@Chris-Wolfgang I've opened a new pull request, #5, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: Chris-Wolfgang <210299580+Chris-Wolfgang@users.noreply.github.com>
…ols-and-editorconfig Complete Step #2: Static Code Analysis - Add missing banned APIs and fix build
Description
Fixes/Complete # (issue)
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
Checklist
Screenshots (if applicable)
Additional context