From a27202e68fdb7a20e0cee387c203f82f967e729b Mon Sep 17 00:00:00 2001 From: David Kwon Date: Wed, 29 Jul 2026 18:04:55 -0400 Subject: [PATCH 1/5] Add codeql workflow Signed-off-by: David Kwon --- .github/workflows/codeql.yml | 67 ++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..2f93a5f1a --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,67 @@ +# +# Copyright (c) 2019-2026 Red Hat, Inc. +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +name: DevWorkspace Operator CodeQL scan + +on: + push: + branches: [ main ] + pull_request: + branches: [ main ] + schedule: + - cron: '15 7 * * 1' + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + permissions: + security-events: write + packages: read + + strategy: + fail-fast: false + matrix: + include: + - language: go + build-mode: manual + + steps: + - name: Checkout repository + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + + - name: Set up Go 1.x + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + with: + go-version: 1.26.5 + + - name: Initialize CodeQL + uses: github/codeql-action/init@c54b30b7df092240050e69945842bc67aee0f0f4 # v4.37.3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + - name: Run manual build steps + if: matrix.build-mode == 'manual' + shell: bash + run: | + make manager + make compile-devworkspace-controller + make compile-webhook-server + - + name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@c54b30b7df092240050e69945842bc67aee0f0f4 # v4.37.3 + with: + category: "/language:${{matrix.language}}" From 865241f0194c08be3be05d9c2911fef5b804bc50 Mon Sep 17 00:00:00 2001 From: David Kwon Date: Wed, 29 Jul 2026 18:20:16 -0400 Subject: [PATCH 2/5] Update commit hash Signed-off-by: David Kwon --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 2f93a5f1a..b7e9afa7b 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -48,7 +48,7 @@ jobs: go-version: 1.26.5 - name: Initialize CodeQL - uses: github/codeql-action/init@c54b30b7df092240050e69945842bc67aee0f0f4 # v4.37.3 + uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -62,6 +62,6 @@ jobs: make compile-webhook-server - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c54b30b7df092240050e69945842bc67aee0f0f4 # v4.37.3 + uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: category: "/language:${{matrix.language}}" From 67abd364cbdcf01263072549a3a10bfc12dae424 Mon Sep 17 00:00:00 2001 From: David Kwon Date: Thu, 30 Jul 2026 11:22:47 -0400 Subject: [PATCH 3/5] Add top level permission and retrieve go version from go.mod Signed-off-by: David Kwon --- .github/workflows/codeql.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b7e9afa7b..1a89cb14e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,6 +23,9 @@ on: schedule: - cron: '15 7 * * 1' +permissions: + contents: read + jobs: analyze: name: Analyze (${{ matrix.language }}) @@ -45,7 +48,7 @@ jobs: - name: Set up Go 1.x uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: - go-version: 1.26.5 + go-version-file: go.mod - name: Initialize CodeQL uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 From d388c29a219654a3f9ac97f6e9c4587a34dfe7fd Mon Sep 17 00:00:00 2001 From: David Kwon Date: Tue, 4 Aug 2026 11:14:21 -0400 Subject: [PATCH 4/5] Add `contents: read` to job-level permissions to restore repo access Signed-off-by: David Kwon --- .github/workflows/codeql.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 1a89cb14e..585bc72bb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,6 +31,7 @@ jobs: name: Analyze (${{ matrix.language }}) runs-on: ubuntu-latest permissions: + contents: read security-events: write packages: read From cd33a04aa3674364fb6751a626b316c38910301b Mon Sep 17 00:00:00 2001 From: dkwon17 Date: Thu, 6 Aug 2026 15:34:14 +0000 Subject: [PATCH 5/5] Update codeql.yml with pullrequest paths targetting go related files Signed-off-by: dkwon17 --- .github/workflows/codeql.yml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 585bc72bb..e8c1d391a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,8 +18,18 @@ name: DevWorkspace Operator CodeQL scan on: push: branches: [ main ] + paths: + - '**.go' + - 'go.mod' + - 'go.sum' + - '.github/workflows/codeql.yml' pull_request: branches: [ main ] + paths: + - '**.go' + - 'go.mod' + - 'go.sum' + - '.github/workflows/codeql.yml' schedule: - cron: '15 7 * * 1' @@ -45,7 +55,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - + with: + persist-credentials: false - name: Set up Go 1.x uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: @@ -64,8 +75,7 @@ jobs: make manager make compile-devworkspace-controller make compile-webhook-server - - - name: Perform CodeQL Analysis + - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: category: "/language:${{matrix.language}}"