Reformt codes and add CodeQL action

.github/workflows/base.yml

@@ -34,14 +34,21 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: recursive
-      - run: cargo fmt --all -- --check
+
+      - name: Install nightly toolchain
+        run: |
+          rustup toolchain install nightly --profile minimal
+          rustup component add rustfmt --toolchain nightly
+
+      - run: cargo +nightly fmt --all --check
 
   #
   clippy:
     name: Clippy Check
     runs-on: ubuntu-latest
     env:
       CARGO_TERM_COLOR: always
+      RUSTUP_TOOLCHAIN: stable
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -71,6 +78,7 @@ jobs:
     runs-on: ${{ matrix.runs-on }}
     env:
       CARGO_TERM_COLOR: always
+      RUSTUP_TOOLCHAIN: stable
       HOME: ${{ matrix.home }}
     steps:
       - name: Install Redis
@@ -111,6 +119,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64]
     env:
       CARGO_TERM_COLOR: always
+      RUSTUP_TOOLCHAIN: stable
     steps:
       - uses: actions/checkout@v4
       - uses: actions-rust-lang/setup-rust-toolchain@v1

.github/workflows/claude-review.yml

@@ -76,12 +76,17 @@ jobs:
         if: ${{ github.event_name == 'pull_request_target' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_HEAD_OWNER: ${{ github.event.pull_request.head.repo.owner.login }}
+          PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.name }}
+          REPO_OWNER: ${{ github.repository_owner }}
         run: |
-          PR_NUMBER=${{ github.event.pull_request.number }}
-          HEAD_REF="${{ github.event.pull_request.head.ref }}"
-          HEAD_OWNER="${{ github.event.pull_request.head.repo.owner.login }}"
-          HEAD_REPO="${{ github.event.pull_request.head.repo.name }}"
-          CURRENT_OWNER="${{ github.repository_owner }}"
+          PR_NUMBER="$PR_NUMBER"
+          HEAD_REF="$PR_HEAD_REF"
+          HEAD_OWNER="$PR_HEAD_OWNER"
+          HEAD_REPO="$PR_HEAD_REPO"
+          CURRENT_OWNER="$REPO_OWNER"
 
           # For forked PRs, temporarily change origin URL to fork repository
           # This allows claude-code-action to fetch the PR branch correctly
@@ -133,7 +138,6 @@ jobs:
 
           # Enable progress tracking and show full Claude output in logs
           track_progress: true
-          show_full_output: true
 
           # Custom review instructions passed to Claude
           prompt: |
@@ -172,3 +176,4 @@ jobs:
           # Restrict tools that Claude can use during the review
           claude_args: |
             --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+

.github/workflows/codeql.yml

@@ -0,0 +1,76 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: 'ubuntu-latest'
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: rust
+          build-mode: none
+        - language: javascript-typescript
+          build-mode: none
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
+    # This includes steps like installing compilers or runtimes (`actions/setup-node`
+    # or others). This is typically only required for manual builds.
+    # - name: Setup runtime (example)
+    #   uses: actions/setup-example@v1
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

README.md

@@ -36,6 +36,55 @@ Mega intergrates Buck2 as default, which is a build system developed by Meta wit
 
 The mega project relies on community contributions and aims to simplify getting started. To develop Mega, clone the repository, then install all dependencies and initialize the database schema, run the test suite and try it out locally. Pick an issue, make changes, and submit a pull request for community review.
 
+### Pre-submission Checks
+Before submitting a Pull Request, please ensure your code passes the following checks:
+
+```bash
+# Run clippy with all warnings treated as errors (warnings will be treated as errors)
+cargo clippy --all-targets --all-features -- -D warnings
+
+# Check code formatting (requires nightly toolchain)
+cargo +nightly fmt --all --check
+```
+
+Both commands must complete without any warnings. The clippy check treats all warnings as errors, and the formatter check ensures code follows the project style guide. Only PRs that pass these checks will be accepted for merge.
+
+
+If the formatting check fails, you can automatically fix formatting issues by running:
+
+```bash
+cargo +nightly fmt --all
+```
+
+### Buck2 Build Requirements
+
+This project builds with Buck2. Please install both Buck2 and cargo-buckal before development:
+
+```bash
+# Install buck2: download the latest release tarball from
+# https://github.com/facebook/buck2/releases, extract the binary,
+# and place it in ~/.cargo/bin (ensure ~/.cargo/bin is on PATH).
+# Example (replace <tag> and <platform> with the latest for your OS):
+wget https://github.com/facebook/buck2/releases/download/<tag>/buck2-<platform>.tar.gz
+tar -xzf buck2-<platform>.tar.gz
+mv buck2 ~/.cargo/bin/
+
+# Install cargo-buckal (requires Rust toolchain)
+cargo install --git https://github.com/buck2hub/cargo-buckal.git
+```
+
+Pull Requests must also pass the Buck2 build:
+
+```bash
+cargo buckal build
+```
+
+When you update dependencies in Cargo.toml, regenerate Buck metadata and third-party lockfiles:
+
+```bash
+cargo buckal migrate
+```
+
 More information on contributing to Mega is available in the [Contributing Guide](docs/contributing.md).
 
 ## Chat with us

ceres/src/api_service/admin_ops.rs

@@ -10,12 +10,12 @@
 //! - Cache keys are namespaced by both instance prefix and root directory
 //! - Empty paths fall back to the default directory (project)
 
-use redis::AsyncCommands;
-
-use crate::api_service::mono_api_service::MonoApiService;
 use common::errors::MegaError;
 use git_internal::internal::object::tree::Tree;
 use jupiter::utils::converter::FromMegaModel;
+use redis::AsyncCommands;
+
+use crate::api_service::mono_api_service::MonoApiService;
 
 /// Cache TTL for admin lists (10 minutes).
 pub const ADMIN_CACHE_TTL: u64 = 600;

ceres/src/api_service/blame_ops.rs

@@ -3,18 +3,23 @@
 //! This module provides a unified blame implementation that works with both
 //! MonoApiService and ImportApiService through the ApiHandler trait.
 
-use std::collections::HashMap;
-use std::path::{Component, Path, PathBuf};
-use std::sync::Arc;
-
-use git_internal::diff::{DiffOperation, compute_diff};
-use git_internal::errors::GitError;
-use git_internal::hash::ObjectHash;
-use git_internal::internal::object::commit::Commit;
-use git_internal::internal::object::tree::TreeItemMode;
-
-use crate::api_service::ApiHandler;
-use crate::model::blame::{BlameBlock, BlameInfo, BlameQuery, BlameResult, Contributor};
+use std::{
+    collections::HashMap,
+    path::{Component, Path, PathBuf},
+    sync::Arc,
+};
+
+use git_internal::{
+    diff::{DiffOperation, compute_diff},
+    errors::GitError,
+    hash::ObjectHash,
+    internal::object::{commit::Commit, tree::TreeItemMode},
+};
+
+use crate::{
+    api_service::ApiHandler,
+    model::blame::{BlameBlock, BlameInfo, BlameQuery, BlameResult, Contributor},
+};
 
 /// Internal structure to track line attribution during history traversal
 struct LineAttribution {

ceres/src/api_service/blob_ops.rs

@@ -4,17 +4,18 @@ use std::{
 };
 
 use common::model::DiffItem;
+use futures::{StreamExt, stream};
 use git_internal::{
     diff::Diff as GitDiff,
     errors::GitError,
     hash::ObjectHash,
     internal::object::{blob::Blob, tree::TreeItemMode},
 };
 
-use crate::api_service::ApiHandler;
-use crate::api_service::tree_ops;
-use crate::model::git::DiffPreviewPayload;
-use futures::{StreamExt, stream};
+use crate::{
+    api_service::{ApiHandler, tree_ops},
+    model::git::DiffPreviewPayload,
+};
 
 /// Convenience: get file blob oid at HEAD (or provided refs) by path
 pub async fn get_file_blob_id<T: ApiHandler + ?Sized>(

ceres/src/api_service/buck_tree_builder.rs

@@ -4,17 +4,27 @@
 //! a batch of file changes. It's designed for the Buck upload API to
 //! create a single atomic commit containing multiple file changes
 
-use std::collections::{HashMap, HashSet};
-use std::path::{Path, PathBuf};
-use std::str::FromStr;
+use std::{
+    collections::{HashMap, HashSet},
+    path::{Path, PathBuf},
+    str::FromStr,
+};
 
 use common::errors::MegaError;
-use git_internal::hash::ObjectHash;
-use git_internal::internal::metadata::EntryMeta;
-use git_internal::internal::object::commit::Commit;
-use git_internal::internal::object::tree::{Tree, TreeItem, TreeItemMode};
-use jupiter::storage::mono_storage::MonoStorage;
-use jupiter::utils::converter::{FromMegaModel, IntoMegaModel};
+use git_internal::{
+    hash::ObjectHash,
+    internal::{
+        metadata::EntryMeta,
+        object::{
+            commit::Commit,
+            tree::{Tree, TreeItem, TreeItemMode},
+        },
+    },
+};
+use jupiter::{
+    storage::mono_storage::MonoStorage,
+    utils::converter::{FromMegaModel, IntoMegaModel},
+};
 
 use crate::model::buck::FileChange;
 
@@ -1786,9 +1796,10 @@ mod tests {
     /// Test Git Sorting Rules
     #[test]
     fn test_git_sort_order() {
-        use git_internal::hash::ObjectHash;
         use std::str::FromStr;
 
+        use git_internal::hash::ObjectHash;
+
         // Setup items
         let blob_hash = ObjectHash::from_str("da39a3ee5e6b4b0d3255bfef95601890afd80709").unwrap();
 

ceres/src/api_service/cache.rs

@@ -1,12 +1,11 @@
 use std::sync::Arc;
 
-use redis::{AsyncCommands, aio::ConnectionManager};
-
 use common::errors::MegaError;
 use git_internal::{
     hash::ObjectHash,
     internal::object::{commit::Commit, tree::Tree},
 };
+use redis::{AsyncCommands, aio::ConnectionManager};
 
 #[derive(Clone)]
 pub struct GitObjectCache {

ceres/src/api_service/commit_ops.rs

@@ -1,24 +1,30 @@
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
+use std::{
+    collections::{BTreeSet, HashMap, HashSet, VecDeque},
+    path::{Path, PathBuf},
+    sync::Arc,
+};
 
 use api_model::git::commit::LatestCommitInfo;
+use common::model::{CommonPage, DiffItem, Pagination};
 use git_internal::{
     errors::GitError,
+    hash::ObjectHash,
     internal::object::{
         commit::Commit,
         tree::{TreeItem, TreeItemMode},
     },
 };
-
-use crate::api_service::{ApiHandler, history, tree_ops};
-use crate::model::change_list::MuiTreeNode;
-use crate::model::commit::{CommitFilesChangedPage, CommitSummary, GpgStatus};
-use crate::model::git::{CommitBindingInfo, LatestCommitInfoWrapper};
-use common::model::{CommonPage, DiffItem, Pagination};
-use git_internal::hash::ObjectHash;
 use redis::AsyncCommands;
 use serde::{Deserialize, Serialize};
-use std::collections::{BTreeSet, HashMap, HashSet, VecDeque};
+
+use crate::{
+    api_service::{ApiHandler, history, tree_ops},
+    model::{
+        change_list::MuiTreeNode,
+        commit::{CommitFilesChangedPage, CommitSummary, GpgStatus},
+        git::{CommitBindingInfo, LatestCommitInfoWrapper},
+    },
+};
 
 /// Compute GPG signature verification status for a commit.
 ///