Add CodeQL static analysis workflow - #505
Conversation
|
@Ugooweb Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
📝 WalkthroughWalkthroughAdds a GitHub Actions CodeQL workflow for JavaScript and TypeScript, triggered on changes to ChangesCodeQL analysis
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 27-28: Update the actions/checkout@v4 step in the CodeQL workflow
to set persist-credentials to false, preventing the GitHub token from remaining
available during subsequent repository-controlled build steps while preserving
the existing checkout behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d6505107-6034-4f99-b0c8-4ba45ec91052
📒 Files selected for processing (1)
.github/workflows/codeql.yml
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/codeql.yml ]; then
nl -ba .github/workflows/codeql.yml | sed -n '1,140p'
else
fd -a 'codeql\.yml$|.github/workflows' . || true
fi
echo
echo "== checkout call sites =="
rg -n "actions/checkout|persist-credentials|permissions:|permissions:\n|security-events|autopos|autobuild|CodeQL|codeql" .github/workflows/codeql.yml .github/workflows -S || true
echo
echo "== repo changed files/stat =="
git diff --name-only HEAD~1..HEAD || true
git diff --stat HEAD~1..HEAD || trueRepository: Stellar-Ecosystem/lodestar
Length of output: 227
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/codeql.yml ]; then
nl -ba .github/workflows/codeql.yml | sed -n '1,180p'
else
echo "missing .github/workflows/codeql.yml"
fd -a .github/workflows -x sh -c 'echo "--- $1"; nl -ba "$1" | sed -n "1,180p"' sh {}
fi
echo
echo "== checkout call sites =="
rg -n "actions/checkout|persist-credentials|permissions:|permissions:\n|security-events|autopos|autobuild|CodeQL|codeql" .github/workflows/codeql.yml .github/workflows -S || true
echo
echo "== changed files/stat =="
git diff --name-only HEAD~1..HEAD || true
git diff --stat HEAD~1.. hendRepository: Stellar-Ecosystem/lodestar
Length of output: 227
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/codeql.yml ]; then
cat -n .github/workflows/codeql.yml | sed -n '1,180p'
else
echo "missing .github/workflows/codeql.yml"
find .github/workflows -maxdepth 1 -type f -print 2>/dev/null || true
fi
echo
echo "== checkout call sites and relevant workflow keys =="
grep -RInE "actions/checkout|persist-credentials|permissions:|security-events|CodeQL|codeql|autobuild|checkout repository" .github/workflows/codeql.yml .github/workflows 2>/dev/null || trueRepository: Stellar-Ecosystem/lodestar
Length of output: 3102
🌐 Web query:
actions/checkout v4 persist-credentials default true token stored .git/config
💡 Result:
In actions/checkout v4, the persist-credentials input defaults to true [1][2][3]. When set to true (or by default), the action configures the authentication token or SSH key to enable subsequent authenticated Git commands within your workflow steps [1][4]. Regarding where the credentials are stored: - In actions/checkout versions prior to v6, credentials were added directly to the local .git/config file [5][6]. - Starting with actions/checkout v6, the action was updated to improve security by storing credentials in a separate file under $RUNNER_TEMP rather than directly in the repository's .git/config [5][6]. This new approach uses Git's includeIf mechanism to conditionally include the credentials, preventing them from being part of the main Git configuration [7][6]. If you wish to prevent the action from configuring these credentials, you can explicitly set persist-credentials: false in your workflow step [1][4]. This is often recommended for increased security to minimize the exposure of your access token [8].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/README.md
- 2: https://github.com/actions/checkout/blob/v4/action.yml
- 3: https://github.com/actions/checkout/blob/v4.1.1/action.yml
- 4: https://spacelift.io/blog/github-actions-checkout
- 5: https://github.com/actions/checkout/blob/main/README.md
- 6: actions/checkout@v5.0.1...v6.0.0
- 7: Persist creds to a separate file actions/checkout#2286
- 8: Change the default value of persist-credentials to false actions/checkout#1687
Disable checkout credential persistence.
actions/checkout@v4 persists the GitHub token by default, and this job grants security-events: write before running repository-controlled build steps. Set persist-credentials: false on the checkout step.
Proposed fix
- name: Checkout repository
uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 27-28: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 27 - 28, Update the
actions/checkout@v4 step in the CodeQL workflow to set persist-credentials to
false, preventing the GitHub token from remaining available during subsequent
repository-controlled build steps while preserving the existing checkout
behavior.
Source: Linters/SAST tools
|
Hi @Ugooweb, This PR could not be merged because it has merge conflicts with the target branch. Please resolve the merge conflicts, push the updated changes, and the PR can be reviewed and merged. Thank you! |
please check |
2 participants
Closes #410
Context
Currently, the repository does not have a static analysis workflow in place.
Problem
Without automated static analysis, potential security vulnerabilities and anti-patterns can make their way into the codebase unnoticed. CodeQL is an industry-standard static analysis tool that is free for public repositories.
Proposed Approach
This PR introduces a GitHub Actions workflow that runs CodeQL static analysis on the Node workspaces (JavaScript and TypeScript).
CodeQL is configured to catch common vulnerabilities such as:
Acceptance Criteria Met
Summary by CodeRabbit