GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Have CodeQL scan GitHub Actions workflows as well as Python code by EliahKagan · Pull Request #2032 · gitpython-developers/GitPython

Conversation

@EliahKagan

@EliahKagan EliahKagan commented May 30, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

This regenerates the codeq.yml workflow to modernize it and to get current defaults, the most (or perhaps only) important one being to scan both python and actions, rather than only python.

Parts of the default that we deliberately deviate from, or that seem preferable to change based on the comments in the default workflow, are put back.

I've tested this in my fork, but I'll still wait for all CI to complete here before merging. Besides being a good usual practice, this also has a chance of catching permissions-related problems.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
EliahKagan added 4 commits May 30, 2025 14:37
@EliahKagan
Temporarily remove CodeQL workflow file
0c0fc7e 
So GitHub can regenerate a fresh new one based on current defaults.
@EliahKagan
Recreate codeq.yml with current defaults
847ead6 
This adds CodeQL scanning of GitHub Actions, while continuing to
scan Python as well.

This will subsequently be customized slightly to restore some
elements of the preivous custom workflow that we may prefer.
@EliahKagan
Keep running CodeQL on all branches, etc.
d7ce09f 
This restores three aspects of the previous `codeql.yml`:

- Run it on all branches, not just `main`.

- Run it on the previous schedule rather than the new one, since
  there's no reason to change the schedule (though there's no
  reason to be attached to the old schedule either).

- Use "CodeQL" rather than "CodeQL Advanced" as the workflow
  `name`, since this takes up less horizontal space when reading
  the reports from the checks.

Of these, only the first is really significant.
@EliahKagan
Remove unnecessary permissions from codeql.yml
89dbd4a 
This is another change back to the way we had it before, but the
removals are based specifically on the guidance in the default
workflow comments about why each permission was given by default.
@github-advanced-security

github-advanced-security AI commented May 30, 2025

Copy link
Copy Markdown

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@EliahKagan

EliahKagan commented May 30, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member Author

This pull request sets up GitHub code scanning for this repository.

I guess this comment was automatically posted because the approach I took was to delete the workflow in the first commit to let GitHub regenerate it. (Or maybe this comment is posted for all changes to the workflow now?)
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@EliahKagan
EliahKagan marked this pull request as ready for review May 30, 2025 19:16
@EliahKagan
EliahKagan merged commit 2e4a0d2 into gitpython-developers:main May 30, 2025
@EliahKagan
EliahKagan deleted the codeql-gha branch May 30, 2025 19:29
EliahKagan added a commit to EliahKagan/GitPython that referenced this pull request May 30, 2025
@EliahKagan
Specify explicit contents: read workflow permissions
d670878 
Three CI workflows that need only `contents: read` permissions and
no other permissions did not have explicit permissions set, and
would therefore be given permissions configured for the repository.

It is recommended to set explicit workflow permissions. This does
so, bringing those workflows inline with `pythonpackage.yml` (which
had this), and closing three `actions/missing-workflow-permissions`
CodeQL alerts (new since gitpython-developers#2032 enabled scanning of GHA workflows).

See also:
https://codeql.github.com/codeql-query-help/actions/actions-missing-workflow-permissions/
@EliahKagan EliahKagan mentioned this pull request May 30, 2025
Specify explicit contents: read workflow permissions #2033
Merged
EliahKagan added a commit to EliahKagan/GitPython that referenced this pull request May 30, 2025
@EliahKagan
Specify explicit contents: read workflow permissions
a9833d6 
Three CI workflows that need only `contents: read` permissions and
no other permissions did not have explicit permissions set, and
would therefore be given default permissions configured for the
repository, which might be more expansive than the workflows need.

It is recommended to set explicit workflow permissions [1]. This
does that, specifying permissions as `pythonpackage.yml` already
did, and closing three `actions/missing-workflow-permissions`
CodeQL alerts (new since gitpython-developers#2032 enabled scanning of GHA workflows).

[1]: https://codeql.github.com/codeql-query-help/actions/actions-missing-workflow-permissions/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@EliahKagan @github-advanced-security
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.