Skip to content

Add codeql workflow #1685

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dkwon17 wants to merge 5 commits into
base: main
Choose a base branch
from
+81 −0
Open

Add codeql workflow #1685

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a27202e
Add codeql workflow
dkwon17 Jul 29, 2026
865241f
Update commit hash
dkwon17 Jul 29, 2026
67abd36
Add top level permission and retrieve go version from go.mod
dkwon17 Jul 30, 2026
d388c29
Add `contents: read` to job-level permissions to restore repo access
dkwon17 Aug 4, 2026
cd33a04
Update codeql.yml with pullrequest paths targetting go related files
dkwon17 Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 81 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,81 @@
#
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
# Copyright (c) 2019-2026 Red Hat, Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: DevWorkspace Operator CodeQL scan

on:
push:
branches: [ main ]
paths:
- '**.go'
- 'go.mod'
- 'go.sum'
- '.github/workflows/codeql.yml'
pull_request:
branches: [ main ]
paths:
- '**.go'
- 'go.mod'
- 'go.sum'
- '.github/workflows/codeql.yml'
schedule:
- cron: '15 7 * * 1'

permissions:
contents: read

jobs:
analyze:
name: Analyze (${{ matrix.language }})
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
packages: read
Comment on lines +36 to +46

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Restore the CodeQL job’s repository read permissions.

The job-level permissions block overrides the top-level block, so contents: read is currently lost. This can prevent actions/checkout and CodeQL from reading the repository. Add contents: read and actions: read to the job permissions.

Proposed fix 
     permissions:
+      actions: read
+      contents: read
       security-events: write
       packages: read
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml around lines 26 - 35, Update the job-level
permissions block for the analyze job to include contents: read and actions:
read alongside the existing security-events: write and packages: read
permissions, preserving the required CodeQL access.


strategy:
fail-fast: false
matrix:
include:
- language: go
build-mode: manual

steps:
- name: Checkout repository
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
Comment thread
coderabbitai[bot] marked this conversation as resolved.
with:
persist-credentials: false
- name: Set up Go 1.x
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
with:
go-version-file: go.mod

- name: Initialize CodeQL
uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}

- name: Run manual build steps
if: matrix.build-mode == 'manual'
shell: bash
run: |
make manager
make compile-devworkspace-controller
make compile-webhook-server
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
with:
category: "/language:${{matrix.language}}"