Skip to content

Commit 8810a63

Browse files
erastusndicoerastusndico
authored
feat: added codeql analysis (#46)
* feat: added codeql analysis ---------
1 parent 894793f commit 8810a63

File tree

1 file changed

+211
-0
lines changed

1 file changed

+211
-0
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
name: "CodeQL Security Analysis"
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
schedule:
11+
- cron: '0 6 * * 1'
12+
13+
permissions:
14+
contents: read
15+
security-events: write
16+
actions: read
17+
# Required for commenting on pull requests
18+
pull-requests: write
19+
issues: write
20+
21+
jobs:
22+
analyze:
23+
name: CodeQL Analysis
24+
runs-on: ubuntu-latest
25+
timeout-minutes: 360
26+
27+
strategy:
28+
fail-fast: false
29+
matrix:
30+
language: [ 'javascript' ]
31+
32+
steps:
33+
- name: Checkout repository
34+
uses: actions/checkout@v4
35+
with:
36+
fetch-depth: 2
37+
38+
- name: Checkout PR head
39+
if: ${{ github.event_name == 'pull_request' }}
40+
run: git checkout HEAD^2
41+
42+
- name: Setup Node.js
43+
if: ${{ matrix.language == 'javascript' }}
44+
uses: actions/setup-node@v4
45+
with:
46+
node-version: '22'
47+
cache: 'npm'
48+
cache-dependency-path: |
49+
CoreDeployable/package-lock.json
50+
CoreRuntime/package-lock.json
51+
CoreFCADS/package-lock.json
52+
CoreGCDS/package-lock.json
53+
CoreGovUK/package-lock.json
54+
CoreKfdApi/package-lock.json
55+
CoreNhsUK/package-lock.json
56+
CoreOUDS/package-lock.json
57+
CoreWDS/package-lock.json
58+
utils/package-lock.json
59+
60+
- name: Install dependencies
61+
if: ${{ matrix.language == 'javascript' }}
62+
run: |
63+
echo "Installing dependencies for CodeQL analysis..."
64+
65+
# Install dependencies for each module that has a package.json
66+
for dir in CoreDeployable CoreRuntime CoreFCADS CoreGCDS CoreGovUK CoreKfdApi CoreNhsUK CoreOUDS CoreWDS utils; do
67+
if [ -f "$dir/package.json" ]; then
68+
echo "Installing dependencies in $dir..."
69+
cd "$dir"
70+
npm ci --omit=dev 2>/dev/null || npm install --omit=dev 2>/dev/null || echo "No package-lock.json found, skipping npm ci for $dir"
71+
cd ..
72+
fi
73+
done
74+
75+
- name: Initialize CodeQL
76+
uses: github/codeql-action/init@v3
77+
with:
78+
languages: ${{ matrix.language }}
79+
queries: security-extended,security-and-quality
80+
config: |
81+
name: "CodeQL Config"
82+
disable-default-queries: false
83+
query-filters:
84+
- exclude:
85+
id: js/unused-local-variable
86+
- exclude:
87+
id: js/debugger-statement
88+
paths-ignore:
89+
- "node_modules"
90+
- "**/*.min.js"
91+
- "**/*.bundle.js"
92+
- "**/dist/**"
93+
- "**/build/**"
94+
- "**/coverage/**"
95+
- "**/*.test.js"
96+
- "**/*.test.ts"
97+
- "**/*.spec.js"
98+
- "**/*.spec.ts"
99+
paths:
100+
- "CoreDeployable/src"
101+
- "CoreRuntime/src"
102+
- "CoreFCADS/src"
103+
- "CoreGCDS/src"
104+
- "CoreGovUK/src"
105+
- "CoreKfdApi/src"
106+
- "CoreNhsUK/src"
107+
- "CoreOUDS/src"
108+
- "CoreWDS/src"
109+
- "utils"
110+
- "pipeline_scripts"
111+
112+
113+
- name: Perform CodeQL Analysis
114+
uses: github/codeql-action/analyze@v3
115+
with:
116+
category: "/language:${{matrix.language}}"
117+
upload: true
118+
119+
120+
- name: Add PR Comment with Security Findings
121+
if: github.event_name == 'pull_request' && always()
122+
uses: actions/github-script@v7
123+
continue-on-error: true
124+
with:
125+
script: |
126+
try {
127+
// Check if this is a pull request
128+
if (!context.payload.pull_request) {
129+
console.log('Not a pull request, skipping comment creation');
130+
return;
131+
}
132+
133+
const comment = `## 🔒 CodeQL Security Analysis Results
134+
135+
CodeQL analysis has been completed for this pull request.
136+
137+
**Language:** ${{ matrix.language }}
138+
**Status:** ${{ job.status }}
139+
140+
📊 **View detailed results:** Check the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning) for complete findings.
141+
142+
💡 **Next steps:**
143+
- Review any security findings in the Security tab
144+
- Address high/critical severity issues before merging
145+
- Consider the recommendations for code quality improvements
146+
147+
---
148+
*This comment was generated automatically by CodeQL Analysis*`;
149+
150+
// Create the comment
151+
await github.rest.issues.createComment({
152+
issue_number: context.issue.number,
153+
owner: context.repo.owner,
154+
repo: context.repo.repo,
155+
body: comment
156+
});
157+
158+
console.log('Successfully posted CodeQL analysis comment on PR');
159+
160+
} catch (error) {
161+
console.log('Failed to post PR comment:', error.message);
162+
console.log('This is non-critical - CodeQL results are still available in the Security tab');
163+
// Don't fail the workflow if comment posting fails
164+
}
165+
166+
codeql-summary:
167+
name: CodeQL Analysis Summary
168+
if: always()
169+
needs: analyze
170+
runs-on: ubuntu-latest
171+
172+
steps:
173+
- name: Check Analysis Results
174+
run: |
175+
echo "CodeQL Analysis Summary:"
176+
echo "======================="
177+
178+
# Check if any analysis jobs failed
179+
if [[ "${{ needs.analyze.result }}" == "failure" ]]; then
180+
echo "❌ CodeQL analysis failed"
181+
echo "Please check the analysis logs for details"
182+
exit 1
183+
elif [[ "${{ needs.analyze.result }}" == "success" ]]; then
184+
echo "✅ CodeQL analysis completed successfully"
185+
echo "Check the Security tab for detailed results: https://github.com/${{ github.repository }}/security/code-scanning"
186+
else
187+
echo "⚠️ CodeQL analysis completed with status: ${{ needs.analyze.result }}"
188+
fi
189+
190+
echo ""
191+
echo "📊 Security findings and recommendations are available in:"
192+
echo " - GitHub Security tab"
193+
echo " - Pull request annotations (if applicable)"
194+
echo " - SARIF artifacts (for detailed analysis)"
195+
196+
- name: Security Recommendations
197+
if: always()
198+
run: |
199+
echo ""
200+
echo "🛡️ Security Best Practices Reminder:"
201+
echo "====================================="
202+
echo "1. Review all high and critical severity findings"
203+
echo "2. Consider security implications of new code changes"
204+
echo "3. Keep dependencies up to date"
205+
echo "4. Follow secure coding practices"
206+
echo "5. Enable branch protection rules requiring CodeQL checks"
207+
echo ""
208+
echo "📚 Resources:"
209+
echo " - CodeQL Documentation: https://codeql.github.com/docs/"
210+
echo " - Security Advisories: https://github.com/advisories"
211+
echo " - GitHub Security Features: https://docs.github.com/en/code-security"

0 commit comments

Comments
 (0)