Skip to content

chore: add CodeQL workflow and badge #154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BryanFRD merged 3 commits into from
Mar 30, 2026
Merged

chore: add CodeQL workflow and badge #154

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a27b01a
chore: add CodeQL workflow and badge
BryanFRD Mar 30, 2026
575c737
chore: remove duplicate CodeQL workflow
BryanFRD Mar 30, 2026
bad8452
chore: remove CodeQL badge (default setup has no workflow file)
BryanFRD Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: CodeQL

on:
push:
branches: [main]
pull_request:
branches: [main]
schedule:
- cron: "0 6 * * 1"

jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
security-events: write

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The job-level permissions block only grants security-events: write; all other scopes (including contents) become none. That can prevent actions/checkout from reading the repository and cause the workflow to fail. Add at least contents: read (and ideally also actions: read per CodeQL guidance) alongside security-events: write.

Suggested change
security-events: write
security-events: write
actions: read
contents: read

Copilot uses AI. Check for mistakes.
steps:
- uses: actions/checkout@v4

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action versions are inconsistent with the rest of the repo: other workflows use actions/checkout@v6 (e.g., .github/workflows/ci.yml:20 and .github/workflows/release.yml:49), but this workflow uses @v4. Aligning versions across workflows reduces maintenance and avoids subtle behavior differences.

Suggested change
- uses: actions/checkout@v4
- uses: actions/checkout@v6

Copilot uses AI. Check for mistakes.
- uses: github/codeql-action/init@v3
with:
languages: actions
- uses: github/codeql-action/analyze@v3
with:
category: /language:actions

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This repository contains JavaScript code (e.g., npm/bin/ferrflow.js), but the CodeQL init is configured to scan only actions. Consider adding javascript-typescript to languages so CodeQL covers the Node wrapper as well. If you add more languages, update/remove the hard-coded category: /language:actions to avoid mislabeling results.

Suggested change
languages: actions
- uses: github/codeql-action/analyze@v3
with:
category: /language:actions
languages: actions, javascript-typescript
- uses: github/codeql-action/analyze@v3

Copilot uses AI. Check for mistakes.
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
[![Release](https://github.com/FerrFlow-Org/FerrFlow/actions/workflows/release.yml/badge.svg)](https://github.com/FerrFlow-Org/FerrFlow/actions/workflows/release.yml)
[![Latest release](https://img.shields.io/github/v/release/FerrFlow-Org/FerrFlow)](https://github.com/FerrFlow-Org/FerrFlow/releases/latest)
[![Coverage](https://codecov.io/gh/FerrFlow-Org/FerrFlow/graph/badge.svg)](https://codecov.io/gh/FerrFlow-Org/FerrFlow)
[![CodeQL](https://github.com/FerrFlow-Org/FerrFlow/actions/workflows/codeql.yml/badge.svg)](https://github.com/FerrFlow-Org/FerrFlow/actions/workflows/codeql.yml)
[![License](https://img.shields.io/github/license/FerrFlow-Org/FerrFlow)](LICENSE)

Universal semantic versioning for monorepos and classic repos.
Expand Down
Loading