CodeQl version upgrade #9916
CodeQl version upgrade #9916
Conversation
WalkthroughThis pull request updates the GitHub Actions workflow configurations for CodeQL analysis. Specifically, the workflow files Changes
Assessment against linked issues
Possibly related PRs
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
✅ Deploy Preview for care-ohc ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/workflows/ossar-analysis.yml (2)
38-38: Document the upgrade reason in workflow comments.Consider adding a comment explaining why this upgrade was necessary (e.g., security improvements, new features, deprecation of v2).
+ # Upgraded to v3 for improved security features and compatibility uses: github/codeql-action/upload-sarif@v3
38-40: Consider pinning to a specific v3.x.x version.While using
@v3is valid, consider pinning to a specific version (e.g.,@v3.2.1) to ensure reproducible builds and avoid unexpected changes from minor version updates.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/codeql-analysis.yml(1 hunks).github/workflows/ossar-analysis.yml(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- .github/workflows/codeql-analysis.yml
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: cypress-run (1)
- GitHub Check: OSSAR-Scan
- GitHub Check: CodeQL-Build
🔇 Additional comments (1)
.github/workflows/ossar-analysis.yml (1)
38-38: Verify compatibility with OSSAR action.The upgrade to
github/codeql-action/upload-sarif@v3looks good, but we should verify compatibility with the fixed OSSAR action version (fae13e456b9973657a670eef6bccc3a4c2b5153d).✅ Verification successful
The upgrade to upload-sarif@v3 is compatible with OSSAR.
The OSSAR action with fixed commit hash produces standard SARIF output which is compatible with all versions of the upload-sarif action. The upgrade from v2 to v3 is safe as it maintains backward compatibility for SARIF processing.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Check if other workflow files also use CodeQL actions that need upgrading rg -l "github/codeql-action/.+@v2" .github/workflows/Length of output: 53
Script:
#!/bin/bash # Check for any CodeQL action usage rg -l "github/codeql-action" .github/workflows/ # Get the complete workflow file content cat .github/workflows/ossar-analysis.yml # Look for any SARIF-related patterns rg "sarif" .github/workflows/ -A 2 -B 2Length of output: 1919
There was a problem hiding this comment.
LGTM
Wondering why dependabot didn't do this. (Never saw it upgrading our actions so far)
Refs:
Proposed Changes
@ohcnetwork/care-fe-code-reviewers
Merge Checklist
Summary by CodeRabbit