From d9b56e4204f628c6e8fe4c58a1b08adee62791e8 Mon Sep 17 00:00:00 2001 From: sushant-suse Date: Mon, 16 Feb 2026 19:39:37 +0530 Subject: [PATCH 1/3] feat #164: added codeql analysis file Signed-off-by: sushant-suse --- .github/workflows/codeql-analysis.yml | 71 +++++++++++++++++++++++++++ changelog.d/164.infra.rst | 1 + 2 files changed, 72 insertions(+) create mode 100644 .github/workflows/codeql-analysis.yml create mode 100644 changelog.d/164.infra.rst diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 00000000..927e8548 --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,71 @@ +name: "CodeQL" + +on: + push: + branches: [ "main" ] + paths: + - 'src/**' + - 'tests/**' + - '.github/workflows/codeql-analysis.yml' + pull_request: + branches: [ "main" ] + paths: + - 'src/**' + - 'tests/**' + - '.github/workflows/codeql-analysis.yml' + schedule: + - cron: '30 18 * * 1' # Runs every Monday at 18:30 UTC + +# Centralize the Python version here for easy updates +env: + PYTHON_VERSION: '3.12' + +permissions: + contents: read + security-events: write + actions: read + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + timeout-minutes: 36 + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'python' ] + + steps: + - name: Checkout repository + uses: actions/checkout@v6 + + - name: Set up Python ${{ env.PYTHON_VERSION }} + uses: actions/setup-python@v6 + with: + python-version: ${{ env.PYTHON_VERSION }} + + - name: Setup uv + uses: astral-sh/setup-uv@v7 + with: + enable-cache: true + cache-dependency-glob: "uv.lock" + + - name: Install dependencies + run: uv sync --frozen --group github-action + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + # Extended suites catch more complex vulnerabilities and code quality smells + queries: security-extended,security-and-quality + + - name: Perform Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" \ No newline at end of file diff --git a/changelog.d/164.infra.rst b/changelog.d/164.infra.rst new file mode 100644 index 00000000..1cb42ca1 --- /dev/null +++ b/changelog.d/164.infra.rst @@ -0,0 +1 @@ +Integrated GitHub CodeQL analysis for automated security scanning of Python source code. \ No newline at end of file From e5ec87884da962cee2a22992f8f9013bc334dbf1 Mon Sep 17 00:00:00 2001 From: sushant-suse Date: Mon, 16 Feb 2026 19:52:38 +0530 Subject: [PATCH 2/3] feat #164: updated CodeQL version 4 Signed-off-by: sushant-suse --- .github/workflows/codeql-analysis.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 927e8548..f1f9c6ca 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -58,14 +58,18 @@ jobs: - name: Install dependencies run: uv sync --frozen --group github-action + # Updated to v4 to avoid deprecation of v3 in late 2026 - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} # Extended suites catch more complex vulnerabilities and code quality smells queries: security-extended,security-and-quality + # Explicitly set the source root to ensure Python files are picked up + source-root: src + # Updated to v4 to match initialization - name: Perform Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4 with: category: "/language:${{matrix.language}}" \ No newline at end of file From ad72bb37da3777bb19f33c3bd34c7992b24a6077 Mon Sep 17 00:00:00 2001 From: sushant-suse Date: Mon, 16 Feb 2026 19:56:33 +0530 Subject: [PATCH 3/3] fragment #164: updated fragment file Signed-off-by: sushant-suse --- changelog.d/164.infra.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changelog.d/164.infra.rst b/changelog.d/164.infra.rst index 1cb42ca1..28798052 100644 --- a/changelog.d/164.infra.rst +++ b/changelog.d/164.infra.rst @@ -1 +1 @@ -Integrated GitHub CodeQL analysis for automated security scanning of Python source code. \ No newline at end of file +Integrated GitHub CodeQL for automated security scanning and data-flow analysis of Python source code. \ No newline at end of file