Skip to content

[scanner] fix: enable CodeQL static analysis workflow#6258

Closed
clubanderson wants to merge 1 commit into
mainfrom
scanner/fix-6257
Closed

[scanner] fix: enable CodeQL static analysis workflow#6258
clubanderson wants to merge 1 commit into
mainfrom
scanner/fix-6257

Conversation

@clubanderson

@clubanderson clubanderson commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Fixes #6257

Changes

Renamed .github/workflows/codeql.yml.disabled → .github/workflows/codeql.yml to restore automated static code analysis.

Impact

Restores automated detection of:

  • XSS vulnerabilities
  • Injection flaws
  • Path-traversal issues
  • Security regressions in sanitizeHtmlForMdx and other TypeScript/JavaScript code

CodeQL will now run:

  • On every push to main
  • On every pull request
  • Weekly on Mondays at 04:00 UTC

Scanner Bot
[scanner] fix: enable CodeQL static analysis workflow
a56b0ee 
Renames .github/workflows/codeql.yml.disabled to codeql.yml to restore
automated SAST scanning for JavaScript/TypeScript code.

This restores automated detection of XSS, injection, and path-traversal
vulnerabilities that were invisible to CI while the workflow was disabled.

Fixes #6257

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Scanner Bot <scanner@kubestellar.io>
Copilot AI review requested due to automatic review settings July 9, 2026 02:49
@clubanderson
clubanderson requested a review from KPRoche as a code owner July 9, 2026 02:49
@kubestellar-prow kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Jul 9, 2026
@netlify

netlify Bot commented Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for kubestellar-docs ready!

Name Link
🔨 Latest commit a56b0ee
🔍 Latest deploy log https://app.netlify.com/projects/kubestellar-docs/deploys/6a4f0c3205504100080d01ba
😎 Deploy Preview https://deploy-preview-6258--kubestellar-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@kubestellar-prow

kubestellar-prow Bot commented Jul 9, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kproche for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubestellar-prow kubestellar-prow Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 9, 2026
Copilot AI reviewed Jul 9, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Restores GitHub CodeQL code-scanning for the docs repository by adding back an enabled workflow intended to run on pushes/PRs to main and on a weekly schedule.

Changes:

  • Add/enable a CodeQL workflow for JavaScript/TypeScript analysis.
  • Configure workflow triggers for push, pull_request, and a weekly cron schedule.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/codeql.yml
Comment on lines +11 to +13
permissions:
contents: read

Comment thread .github/workflows/codeql.yml
@@ -0,0 +1,34 @@
name: CodeQL Analysis
Comment thread .github/workflows/codeql.yml
Comment on lines +22 to +23
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@clubanderson

clubanderson commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ CI Failure Root Cause: CodeQL default setup is already enabled on this repo. The error is:

CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled

Fix: A repo admin needs to disable the CodeQL default setup in Settings → Code security → Code scanning → CodeQL analysis before this advanced workflow can upload results. Once default setup is disabled, this PR's workflow will succeed on the next push.

Alternatively, if the default setup already provides sufficient coverage, this PR may be unnecessary — the default setup is already running javascript-typescript analysis.

@clubanderson

clubanderson commented Jul 9, 2026

Copy link
Copy Markdown
Contributor Author

Closing — CodeQL default setup is already enabled on this repository, which provides the same static analysis coverage. The advanced workflow (.github/workflows/codeql.yml) conflicts with it, causing the error:

CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled

No action needed — code scanning is already active via default setup.

@clubanderson clubanderson mentioned this pull request Jul 9, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@KPRoche KPRoche Awaiting requested review from KPRoche KPRoche is a code owner

Assignees

No one assigned

Labels

ci-cd dco-signoff: yes Indicates the PR's author has signed the DCO. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. yaml

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[sec-check] CodeQL static analysis disabled — code scanning gap on docs repo

2 participants

@clubanderson