ci: add CodeQL analysis workflow#1414
Conversation
|
Warning Review limit reached
More reviews will be available in 16 minutes and 27 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow ChangesCodeQL Security Analysis Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
superdav42
added
origin:interactive
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
🔨 Build Complete - Ready for Testing!📦 Download Build Artifact (Recommended)Download the zip build, upload to WordPress and test:
🌐 Test in WordPress Playground (Very Experimental)Click the link below to instantly test this PR in your browser - no installation needed! Login credentials: |
🔨 Build Complete - Ready for Testing!📦 Download Build Artifact (Recommended)Download the zip build, upload to WordPress and test:
🌐 Test in WordPress Playground (Very Experimental)Click the link below to instantly test this PR in your browser - no installation needed! Login credentials: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 36: Replace the mutable tags for the CodeQL actions with immutable full
commit SHAs: change "github/codeql-action/init@v3" and
"github/codeql-action/analyze@v3" to their corresponding full commit SHAs (e.g.,
github/codeql-action/init@<full-sha> and
github/codeql-action/analyze@<full-sha>), ensuring both entries use explicit
commit hashes rather than version tags; fetch the current recommended commit
SHAs from the codeql-action repository releases or the action's default branch
commit history and update the workflow accordingly.
- Around line 32-33: The checkout step using actions/checkout (the step with
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5) must disable
credential persistence to avoid leaving the runner configured with the
GITHUB_TOKEN; add the key persist-credentials: false under that checkout step
and keep any existing keys (e.g., ref or fetch-depth) intact so the action still
behaves the same but no credentials are persisted to the runner.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0d961175-e76c-4ca1-9393-2d1fd8b4ceca
📒 Files selected for processing (1)
.github/workflows/codeql.yml
🔨 Build Complete - Ready for Testing!📦 Download Build Artifact (Recommended)Download the zip build, upload to WordPress and test:
🌐 Test in WordPress Playground (Very Experimental)Click the link below to instantly test this PR in your browser - no installation needed! Login credentials: |
|
CLAIM_RELEASED reason=worker_complete runner=superdav42 ts=2026-06-12T23:14:46Z aidevops_version=3.20.57 opencode_version=1.17.4 |
2 participants
Summary
main, a weekly schedule, and manual dispatch.+security-and-qualityqueries so GitHub receives code quality/code scanning results for the supported analyzed language.Verification
git diff --checkNotes
main, rerun checks or update open PR branches so the CodeQL code quality requirement receives fresh results.aidevops.sh v3.20.57 plugin for OpenCode v1.17.4 with gpt-5.5 spent 13m and 221,882 tokens on this with the user in an interactive session.
Summary by CodeRabbit