Repository navigation
ci(github): use CodeQL security-and-quality suite - #1859
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a CodeQL configuration excluding ChangesCodeQL Analysis Configuration
SearchQuery Local Constant
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/codeql/config.yml:
- Around line 3-4: The CodeQL config uses paths-ignore to exclude src/contrib
but with build-mode: manual that has no effect because CodeQL analyzes whatever
the build compiles; update the setup by either modifying your manual build steps
to stop compiling files under src/contrib (adjust your build
scripts/Makefile/CMakeLists so src/contrib is not built) or remove the
paths-ignore and add a post-processing SARIF filter (filter-sarif) to drop
alerts from src/contrib; reference the keys and values in the config
(paths-ignore, build-mode: manual, src/contrib, filter-sarif) when making the
change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: fb88e928-82b8-49b6-874d-fea9d6bb356d
📒 Files selected for processing (2)
.github/codeql/config.yml.github/workflows/analyze-codeql.yaml
65b803e to
0ea0747
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/codeql/config.yml (1)
3-4:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift
paths-ignorewill not excludesrc/contribin this C/C++ manual-build setup.With compiled-language extraction, CodeQL analyzes files that the build compiles. Excluding
src/contribhere won’t be effective unless build steps stop compiling that directory (or SARIF is post-filtered).For github/codeql-action/init@v4 with language c-cpp and build-mode manual, does paths-ignore in a CodeQL config file exclude compiled directories from analysis?🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/codeql/config.yml around lines 3 - 4, The config uses paths-ignore for src/contrib which does not prevent compiled C/C++ files from being analyzed in manual build mode; remove or stop relying on paths-ignore in .github/codeql/config.yml and instead change the workflow/build to avoid compiling src/contrib (or post-filter uploaded SARIF results) so CodeQL never sees those object files; reference the paths-ignore setting and the manual-build codeql action invocation when making the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/libs/registry/searchquery.cpp`:
- Around line 119-121: Remove the test-only dead constant kCodeQLTestUrl from
the anonymous namespace in searchquery.cpp: delete the declaration
[[maybe_unused]] const char *kCodeQLTestUrl = "http://example.org/test"; and any
references to it, leaving no test-only artifacts in production runtime code
(ensure builds/tests still pass after removal).
---
Duplicate comments:
In @.github/codeql/config.yml:
- Around line 3-4: The config uses paths-ignore for src/contrib which does not
prevent compiled C/C++ files from being analyzed in manual build mode; remove or
stop relying on paths-ignore in .github/codeql/config.yml and instead change the
workflow/build to avoid compiling src/contrib (or post-filter uploaded SARIF
results) so CodeQL never sees those object files; reference the paths-ignore
setting and the manual-build codeql action invocation when making the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 1bdd2ac7-0a52-4d4a-ac3f-ffc6252d65d6
📒 Files selected for processing (3)
.github/codeql/config.yml.github/workflows/analyze-codeql.yamlsrc/libs/registry/searchquery.cpp
0ea0747 to
5e90464
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (2)
src/libs/registry/searchquery.cpp (1)
119-121:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winRemove test-only dead code from production source.
This issue was previously flagged and remains unresolved. The
[[maybe_unused]]constantkCodeQLTestUrlserves no functional purpose in production runtime code and should be removed. Test artifacts belong in test files, not in production modules.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/libs/registry/searchquery.cpp` around lines 119 - 121, Remove the test-only dead constant kCodeQLTestUrl from production code: delete the [[maybe_unused]] const char *const kCodeQLTestUrl declaration inside the anonymous namespace in searchquery.cpp; if that makes the anonymous namespace empty, remove the namespace block entirely to avoid leaving unused scaffolding, then rebuild/run tests to ensure no references remain to kCodeQLTestUrl..github/codeql/config.yml (1)
3-4:⚠️ Potential issue | 🟠 Major | ⚖️ Poor tradeoff
paths-ignorewill not excludesrc/contribfrom CodeQL analysis with manual build mode.This issue was previously flagged and remains unresolved. When using
build-mode: manualfor C/C++ (as configured in the workflow), CodeQL analyzes whatever your build compiles—paths-ignorehas no effect. To excludesrc/contrib, you must either modify your build configuration to skip compiling those files, or post-process results with filter-sarif.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/codeql/config.yml around lines 3 - 4, The CodeQL config's paths-ignore entry ("paths-ignore: - src/contrib") won't prevent analysis when C/C++ is run in build-mode: manual; either update the build to avoid compiling src/contrib (e.g., remove or conditionally skip those files in your C/C++ build system so CodeQL's manual compilation step never sees them) or add a SARIF post-processing step using filter-sarif to drop findings under src/contrib after analysis; choose one approach and implement it consistently with the workflow that sets build-mode: manual.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/analyze-codeql.yaml:
- Line 37: The packs entry is using a file path instead of a pack reference;
update the packs parameter value from the path-style string to the pack
reference "codeql/cpp-queries" (i.e., remove
":codeql-suites/cpp-security-experimental.qls") in the workflow step that sets
packs so the CodeQL Action v4 receives scope/name[`@version`] only, and if you
need the experimental suite include the .qls via a CodeQL configuration file or
suite definition rather than appending the .qls path to the packs parameter.
- Around line 33-41: Remove the experimental analysis-kinds parameter by
deleting the line "analysis-kinds: code-scanning,code-quality" from the CodeQL
init block; then review the query selection composed of "queries:
security-and-quality" and "packs:
codeql/cpp-queries:codeql-suites/cpp-security-experimental.qls" and either
remove the experimental pack or the queries entry so you don't select
overlapping/conflicting query sets (replace the experimental pack with a stable
pack if needed), keeping the "languages", "build-mode", "config-file", and
caching settings unchanged.
---
Duplicate comments:
In @.github/codeql/config.yml:
- Around line 3-4: The CodeQL config's paths-ignore entry ("paths-ignore: -
src/contrib") won't prevent analysis when C/C++ is run in build-mode: manual;
either update the build to avoid compiling src/contrib (e.g., remove or
conditionally skip those files in your C/C++ build system so CodeQL's manual
compilation step never sees them) or add a SARIF post-processing step using
filter-sarif to drop findings under src/contrib after analysis; choose one
approach and implement it consistently with the workflow that sets build-mode:
manual.
In `@src/libs/registry/searchquery.cpp`:
- Around line 119-121: Remove the test-only dead constant kCodeQLTestUrl from
production code: delete the [[maybe_unused]] const char *const kCodeQLTestUrl
declaration inside the anonymous namespace in searchquery.cpp; if that makes the
anonymous namespace empty, remove the namespace block entirely to avoid leaving
unused scaffolding, then rebuild/run tests to ensure no references remain to
kCodeQLTestUrl.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: ad76667d-ab45-4556-a1b3-bd586f984f4f
📒 Files selected for processing (3)
.github/codeql/config.yml.github/workflows/analyze-codeql.yamlsrc/libs/registry/searchquery.cpp
5e90464 to
b48f305
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
b48f305 to
dd428d6
Compare
dd428d6 to
7a3b1da
Compare
Summary by CodeRabbit