Switch to CodeSQL v3 #102
Switch to CodeSQL v3 #102
Conversation
WalkthroughThis pull request updates the GitHub CodeQL analysis workflow. In the workflow file, the versions of the CodeQL actions for both initialization and analysis have been bumped from v2 to v3. No changes have been made to the workflow’s underlying logic or structure. Changes
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/codeql-analysis.yml (1)
88-89: Update commented-out autobuild action version.While the active CodeQL actions have been updated to v3, there's a commented-out autobuild action still referencing v2.
- # uses: github/codeql-action/autobuild@v2 + # uses: github/codeql-action/autobuild@v3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/codeql-analysis.yml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (4)
- GitHub Check: Build Tinyphone macOS
- GitHub Check: Build Tinyphone Windows
- GitHub Check: Build Tinyphone Linux
- GitHub Check: Analyze (cpp)
🔇 Additional comments (1)
.github/workflows/codeql-analysis.yml (1)
59-59:✅ Verification successful
Verify CodeQL v3 compatibility and consider new features.
The upgrade to CodeQL v3 looks good. However, let's verify the compatibility and new features available.
Also applies to: 103-103
🌐 Web query:
What are the breaking changes and new features in GitHub CodeQL v3 compared to v2?💡 Result:
The transition from GitHub CodeQL Action v2 to v3 introduced several breaking changes and new features aimed at improving performance, security, and usability:
Breaking Changes
Workflow Configuration
- Deprecation of
actions/download-artifact@v3: Starting November 2024, workflows must migrate toactions/download-artifact@v4for debug artifact handling[4][10].- Python Dependency Installation Disabled by Default: The Action no longer installs Python dependencies automatically (improving analysis speed). Override via
CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION=falsetemporarily[4].Java/Kotlin Analysis
- Legacy environment variables (
ODASA_JAVA_LAYOUT,ODASA_TOOLS, etc.) are no longer supported in Java/Kotlin extractors[1].Bundle Tagging
- CodeQL bundles now use semantic versioning (e.g.,
codeql-bundle-v2.13.4) instead of date-based tags likecodeql-bundle-20230615[4][6].CLI Requirements
- Minimum CLI version increased to CodeQL 2.11.6+ for compatibility with newer Actions[4].
New Features
Performance Improvements
- Zstandard Compression: Bundles now use Zstandard compression (~30% smaller size) for faster downloads[6].
- Fine-Grained Dependency Tracking: IDE language servers enable incremental error-checking after code edits[1][6].
Analysis Enhancements
- CodeQL Model Packs (GA): Extend coverage for custom libraries/frameworks via published model packs (C/C++, C#, Java/Kotlin, Python, Ruby)[2].
- Precompiled Queries (
.qlx): Improve cross-CLI compatibility and reduce query compilation time[3][6].Security & Reliability
- SARIF File Limits Increased: Maximum SARIF runs per file raised from 15 to 20[4].
- CVE Fixes: Addressed vulnerabilities like CVE-2024-25129 (data exfiltration risks)[6].
Language-Specific Updates
- Python:
- Globs (e.g.,
folder/**/*.py) are now properly handled inpathsconfigurations[1].- New query
py/http-response-splittingdetects HTTP header injection vulnerabilities[1].- Go/C#/Java: Dependency caching reduces redundant scans[5].
Migration Summary
Aspect CodeQL v2 CodeQL v3 Artifact Download download-artifact@v3download-artifact@v4[4][10]Python Dependencies Installed by default Disabled by default [4] Bundle Tags Date-based (e.g., 20230615)Semantic versioning (e.g., v2.x) [4][6]Query Execution Legacy QL compilation Precompiled .qlxsupport [3][6]For full migration steps, refer to GitHub's CodeQL Action v3 documentation[8][9].
Citations:
- 1: https://codeql.github.com/docs/codeql-overview/codeql-changelog/codeql-cli-2.17.3/
- 2: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning
- 3: https://codeql.github.com/docs/codeql-overview/codeql-changelog/codeql-cli-2.12.0/
- 4: https://github.com/github/codeql-action/blob/main/CHANGELOG.md
- 5: https://github.blog/changelog/label/codeql/
- 6: https://github.com/github/codeql-cli-binaries/blob/main/CHANGELOG.md?plain=1
- 7: 📢 Node 16 deprecation, upcoming CodeQL Action v3 📢 github/codeql-action#1959
- 8: https://github.com/github/codeql-action
- 9: https://github.blog/changelog/2024-01-12-code-scanning-deprecation-of-codeql-action-v2/
- 10: https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
CodeQL v3 Upgrade Verified – Confirm New Defaults as Needed
The workflow upgrade to CodeQL v3 is correctly applied on both the initialization (line 59) and analysis (line 103) steps. Based on the latest documentation, please double-check the following in your project context:
- Python Dependencies: CodeQL v3 disables automatic Python dependency installation by default. If your analysis requires Python support, add an explicit flag (e.g.,
CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION=false).- Artifact Handling: Although not directly changed in this file, be aware that future workflows may need to upgrade from
actions/download-artifact@v3to v4 for debug artifact management.- Legacy Configurations: For projects using Java/Kotlin extractors or similar settings, confirm that any legacy environment variables are updated per v3 requirements.
Overall, no direct modifications are needed in this file, but please verify that these new defaults align with your project’s needs.
|
✅ Build tinyphone 1.0.427 completed (commit 0dce8319cd by @kingster) |
1 similar comment
|
✅ Build tinyphone 1.0.427 completed (commit 0dce8319cd by @kingster) |
Summary by CodeRabbit