Repository navigation
ci: automate CodeQL and action dependency merges - #27
Conversation
Preserve required analysis names and language coverage through an explicit pull-request workflow with minimal permissions. Closes #26
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 28 minutes. View limit details
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Configure and run CodeQL analysis .github/workflows/codeql.yml |
The workflow defines triggers and permissions, then checks out the repository, initializes CodeQL with build mode none, and analyzes Actions, JavaScript/TypeScript, and Rust. |
Priority:
Estimated code review effort: 2 (Simple) | ~8 minutes
Change: Feature · Severity of issue fixed: Medium
Merge Risk: 
269ea
-
No actionable defect is established. The workflow is mergeable, with live analysis and Dependabot uploads still requiring qualification when advanced setup is enabled.
Pre-merge checks: 
-
Check name Status Explanation Resolution Linked Issues check The workflow implements the requested triggers, Actions/JavaScript-TypeScript/Rust matrix, build-mode: none, categories, job names, pinned actions, minimal permissions, andpull_requesthandling. …Publish the workflow, switch the repository from default CodeQL setup to advanced setup without removing or relaxing the required Analyze (actions)check, and verify a Dependabot pull request runs that job. Do not modify the Dependabot br…-
Check name Status Explanation Out of Scope Changes check The only changed file is .github/workflows/codeql.yml. Its triggers, CodeQL matrix, permissions, pinned actions, and analysis configuration directly implement issue#26. No unrelated product or repo…Title check The title clearly identifies the CodeQL automation change, which is the main change. The reference to action dependency merges is not reflected in the provided file summary, but the title remains subs… Description check The pull request description directly describes the CodeQL workflow changes, including triggers, languages, permissions, validation, and Dependabot-related requirements. It is related to the changeset… Full details: Out of Scope Changes check
-
Explanation
The only changed file is
.github/workflows/codeql.yml. Its triggers, CodeQL matrix, permissions, pinned actions, and analysis configuration directly implement issue#26. No unrelated product or repository changes are present.
Full details: Title check
-
Explanation
The title clearly identifies the CodeQL automation change, which is the main change. The reference to action dependency merges is not reflected in the provided file summary, but the title remains substantially related.
Full details: Description check
-
Explanation
The pull request description directly describes the CodeQL workflow changes, including triggers, languages, permissions, validation, and Dependabot-related requirements. It is related to the changeset.
-
Full details: Linked Issues check
-
Explanation
The workflow implements the requested triggers, Actions/JavaScript-TypeScript/Rust matrix,
build-mode: none, categories, job names, pinned actions, minimal permissions, andpull_requesthandling. The workflow does not establish that default setup was switched off or thatAnalyze (actions)ran for a Dependabot pull request. The PR description states that publishing, setup migration, and Dependabot qualification remain pending. Issue#26requires those conditions before completion.Resolution
Publish the workflow, switch the repository from default CodeQL setup to advanced setup without removing or relaxing the required
Analyze (actions)check, and verify a Dependabot pull request runs that job. Do not modify the Dependabot branch manually.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
polaz
changed the title
Use authenticated Dependabot metadata and signed bot commits to enable native auto-merge for GitHub Actions updates, including major versions. Require the expected head and retain protected-branch validation.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9ce556fe1c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Keep merge admission in a repository-bound metadata-only workflow with bot author, signed commit and exact-head checks. No pull-request code is checked out or executed. Dependabot token permissions require native qualification on its actual PR after merge; this GitHub context cannot be reproduced by a local unit test.
Use the same admission job for pull_request checks and trusted target authorization. Only the target event can enable native auto-merge. Both GitHub event contexts require live qualification after publication.
## Summary Run feature CI once per pull request, retain main-push validation and supersede obsolete PR runs. Check documentation links at the start of the Linux contract job and run the existing CodeQL language matrix one job at a time. Preserve the full Linux/browser suite, native macOS/Windows checks, CodeQL query coverage and analysis categories. Pin Actions by commit, keep Rust on stable and disable unused checkout credential persistence. Dependabot admission is unchanged. ## Validation actionlint, workflow security auditing and documentation link checks pass. Configuration comparisons verify that the build/test commands, native matrix, documentation arguments and CodeQL language/category settings are retained. GitHub Actions provides live workflow qualification. ## Landing Based on the setup merged in #27. Documentation is enforced inside the required Linux contract job; the redundant standalone required status is retired. All other required checks retain their names and coverage. Closes #28
Summary
Add an explicit CodeQL workflow so dependency pull requests receive the required
analysis checks. Scan Actions, JavaScript/TypeScript and Rust on pull requests to
main, main pushes, manual dispatch and a weekly schedule.
Preserve the existing Analyze job names, analysis categories and default queries.
Use pull_request for Dependabot analysis uploads, minimal permissions and pinned
actions, without additional repository secrets.
Enable native auto-merge for signed Dependabot GitHub Actions updates, including
major versions. A separate metadata-only workflow verifies bot commits and the
expected head in a trusted pull_request_target context without checking out
pull-request code. The full CI/platform matrix
and CodeQL checks remain required; ordinary pull requests retain manual review.
Validation
The workflows pass actionlint. The zizmor audit reports the metadata-only
privileged trigger; that warning is not suppressed.
GitHub Actions runs the analysis matrix alongside full CI. Dependabot qualification
requires its branch to incorporate the workflow after merge.
Closes #26