CI/CD: added securiy scanning, and code quality checks#1
Conversation
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
There was a problem hiding this comment.
Pull request overview
This PR introduces repository automation for security scanning and dependency maintenance via GitHub Actions workflows and Dependabot configuration.
Changes:
- Added a GitHub Actions workflow to run Gitleaks on pushes/PRs for secret scanning.
- Added a GitHub Actions workflow to run CodeQL analysis on pushes/PRs and on a weekly schedule.
- Added Dependabot configuration for weekly GitHub Actions dependency updates.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| .github/workflows/security-secrets.yml | Adds a Gitleaks-based secret scanning workflow for push and PR events. |
| .github/workflows/security-codeql.yml | Adds a CodeQL workflow for C++ code scanning on push/PR and a weekly cron schedule. |
| .github/dependabot.yml | Configures weekly Dependabot updates for GitHub Actions dependencies. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: RovxBot <107164880+RovxBot@users.noreply.github.com>
[WIP] Update CI/CD security scanning and code quality checks
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 10 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@copilot open a new pull request to apply changes based on the comments in this thread |
Co-authored-by: RovxBot <107164880+RovxBot@users.noreply.github.com>
Harden CI workflows: pin actions to commit SHAs and fix configurations
This pull request adds important security and maintenance automation to the repository by introducing new GitHub workflows and configuration files. The changes help ensure regular dependency updates and automated scanning for code vulnerabilities and secrets.
Security automation:
.github/workflows/security-codeql.ymlto run CodeQL analysis on pushes, pull requests, and a weekly schedule, improving detection of code vulnerabilities in C++ code..github/workflows/security-secrets.ymlto run Gitleaks on pushes and pull requests for secret scanning, helping prevent accidental exposure of sensitive information.Dependency management:
.github/dependabot.ymlto enable weekly automated dependency updates for GitHub Actions, with a limit of five open pull requests at a time.