ci(codeql): replace GitHub-generated template with minimal-scope SHA-pinned config - #11
Conversation
…ig (security-extended, SHA-pinned)
There was a problem hiding this comment.
Pull request overview
Replaces the GitHub-generated CodeQL workflow template with a smaller, SHA-pinned configuration that narrows scanning scope (languages + query pack) and avoids running on every PR.
Changes:
- Pins
actions/checkoutandgithub/codeql-action/*to full commit SHAs. - Restricts CodeQL analysis to
pythonandjavascript-typescriptwithsecurity-extendedqueries only. - Adjusts triggers to run on
pushtomain, weekly scheduled cron, and manual dispatch.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Branch protections: the per-push block can be skipped on a docs-only | ||
| # change via `[skip ci]` or `[codeql skip]` in the commit message. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1fed833ba8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| include: | ||
| - language: actions | ||
| build-mode: none | ||
| - language: c-cpp | ||
| build-mode: none | ||
| - language: javascript-typescript | ||
| build-mode: none | ||
| - language: python | ||
| build-mode: none | ||
| - language: rust | ||
| build-mode: none | ||
| # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' | ||
| # Use `c-cpp` to analyze code written in C, C++ or both | ||
| # Use 'java-kotlin' to analyze code written in Java, Kotlin or both | ||
| # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both | ||
| # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, | ||
| # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. | ||
| # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how | ||
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| # Add any setup steps before running the `github/codeql-action/init` action. | ||
| # This includes steps like installing compilers or runtimes (`actions/setup-node` | ||
| # or others). This is typically only required for manual builds. | ||
| # - name: Setup runtime (example) | ||
| # uses: actions/setup-example@v1 | ||
| - language: python | ||
| build-mode: none | ||
| - language: javascript-typescript | ||
| build-mode: none |
There was a problem hiding this comment.
When a workflow change introduces expression injection or unsafe permission/checkout behavior, this matrix prevents the CodeQL Actions extractor from running, so neither the push nor weekly scan can report it. The stated substitute is not equivalent: .github/workflows/supply-chain-audit.yml lines 3-10 expressly say workflow-edit and action-unpinning heuristics were removed, and its scan only checks narrow payload signatures and dependency bounds. Full-SHA pins protect action references, not vulnerabilities in ${{ ... }} interpolation or run: scripts, so retain language: actions or provide equivalent semantic workflow scanning.
AGENTS.md reference: AGENTS.md:L155-L164
Useful? React with 👍 / 👎.
| include: | ||
| - language: actions | ||
| build-mode: none | ||
| - language: c-cpp | ||
| build-mode: none | ||
| - language: javascript-typescript | ||
| build-mode: none | ||
| - language: python | ||
| build-mode: none | ||
| - language: rust | ||
| build-mode: none | ||
| # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' | ||
| # Use `c-cpp` to analyze code written in C, C++ or both | ||
| # Use 'java-kotlin' to analyze code written in Java, Kotlin or both | ||
| # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both | ||
| # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, | ||
| # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. | ||
| # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how | ||
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| # Add any setup steps before running the `github/codeql-action/init` action. | ||
| # This includes steps like installing compilers or runtimes (`actions/setup-node` | ||
| # or others). This is typically only required for manual builds. | ||
| # - name: Setup runtime (example) | ||
| # uses: actions/setup-example@v1 | ||
| - language: python | ||
| build-mode: none | ||
| - language: javascript-typescript | ||
| build-mode: none |
There was a problem hiding this comment.
This matrix now excludes both compiled-language products that are tracked in the repository: the signed apps/bootstrap-installer/src-tauri Rust installer and the loadable native/fts5_cjk/fts5_cjk.c SQLite extension. Security defects in either component will therefore never be analyzed, even though the replaced workflow already included rust and c-cpp with supported none builds. The claim that Python and JavaScript are the only source ecosystems does not match the checked-in production code, so retain those two matrix entries.
AGENTS.md reference: AGENTS.md:L155-L164
Useful? React with 👍 / 👎.
bbasketballer75
left a comment
bbasketballer75
left a comment
There was a problem hiding this comment.
🤖 hermes automated review
- 1 files changed, 49 additions, 85 deletions
⚠️ tests not run (no test command detected)
No heuristic issues detected.
Review generated by hermes pr-reviewer. Trust but verify.
Three corrections from review:
1. The header advertised `[codeql skip]` as a way to skip the per-push
run. GitHub Actions honors only a fixed set of skip keywords, so that
token does nothing — removed, leaving `[skip ci]`.
2. The matrix analyzed only python + javascript on the stated rationale
that they are "the two source ecosystems". That is not true: the repo
checks in a Rust installer (apps/bootstrap-installer/src-tauri) and a
C SQLite extension (native/fts5_cjk/fts5_cjk.c). Restored `rust` and
`c-cpp`.
3. Restored `actions`. SHA pinning does not address `${{ }}` expression
injection or `run:` script issues, and supply-chain-audit.yml
explicitly dropped the workflow-edit / action-unpinning heuristics, so
it is not the equivalent coverage the comment claimed.
Adds .github/codeql/codeql-config.yml so the new c-cpp analysis excludes
the vendored SQLite amalgamation under native/fts5_cjk/vendor — that is
upstream code we neither wrote nor patch, and including it would bury our
own findings.
Also lands the contributors/emails mapping the attribution gate requires.
|
All three content findings fixed in Copilot — bogus skip token. Correct: GitHub Actions honors only a fixed set of skip keywords, so Codex — dropped Codex — dropped Added Both blocking gates handled: 🤖 Addressed by Claude Code |
Summary
Replaces the GitHub-generated CodeQL template that landed earlier today with a minimal-scope, SHA-pinned variant — same content as NousResearch#74396 against the upstream repo.
Diff vs the GitHub-generated template
actions/checkout@v4,github/codeql-action/init@v4(tag-pinned)de0fac2e4…,3b0bd1d11…) per repo conventionsecurity-and-quality(broader, FP-heavy on this codebase)security-extended(CVE-class only)python+javascript-typescriptonlypush+pull_request(would block PRs)push-to-main+ weekly cron + manual dispatch'31 11 * * 6'(load-spreading)'0 6 * * 1'(Mon 06:00 UTC)CodeQL AdvancedCodeQLNet diff: -85 / +49 (smaller, stricter).
Why this fork differs from upstream
Upstream NousResearch/hermes-agent is unaffected. The matching PR is NousResearch#74396 against NousResearch, which is open and waiting on maintainer review. This fork gets the same config now so you don't have to wait on the upstream pipeline to see CodeQL findings on your own branches.
Test plan
codeql.ymlsha256 matches Hermes-Workspace reference (4e47d0d23ea408f7)security-extended's expected baseline