From 4845b78472645597e642f87297962e8e1fba6382 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 2 May 2026 14:56:36 +0000 Subject: [PATCH 1/2] ci: add CodeQL scanning workflow for Rust and Actions GitHub's Default setup detected two missing configurations on main: - /language:rust - /language:actions This workflow runs CodeQL analysis for both languages on every push to main, every pull request targeting main, and on a weekly schedule (Monday 06:15 UTC). The category values match the slugs that GitHub expects, resolving the 'configurations not found' warning. Co-authored-by: Andy Babic --- .github/workflows/codeql.yml | 71 ++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..c05f850 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,71 @@ +name: CodeQL + +on: + push: + branches: + - main + pull_request: + branches: + - main + schedule: + # Run a full scan every Monday at 06:15 UTC. + - cron: "15 6 * * 1" + +permissions: + contents: read + security-events: write + +jobs: + analyze-rust: + name: Analyze Rust + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@stable + + - name: Cache Cargo build artifacts + uses: Swatinem/rust-cache@v2 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: rust + # Category must match the slug reported by GitHub Default setup. + build-mode: manual + + - name: Build for CodeQL + run: cargo build --release + + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@v3 + with: + category: /language:rust + + analyze-actions: + name: Analyze GitHub Actions + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: actions + build-mode: none + + - name: Perform CodeQL analysis + uses: github/codeql-action/analyze@v3 + with: + category: /language:actions From eedc913bcab51596e0b5892ab823b3b2be94c047 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 2 May 2026 15:01:05 +0000 Subject: [PATCH 2/2] =?UTF-8?q?ci:=20remove=20custom=20CodeQL=20workflow?= =?UTF-8?q?=20=E2=80=94=20Default=20setup=20is=20already=20enabled?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The custom codeql.yml conflicted with GitHub's Default setup in two ways: - Rust does not support build-mode: manual (only 'none' is supported) - SARIF uploads from advanced configurations are rejected when Default setup is already enabled for the repository GitHub's Default setup already handles /language:rust and /language:actions scanning automatically. The 'configurations not found' warning only appeared because Default setup had not yet run on the PR branch; once merged to main it runs normally. The custom workflow is not needed and must be removed. Co-authored-by: Andy Babic --- .github/workflows/codeql.yml | 71 ------------------------------------ 1 file changed, 71 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index c05f850..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: CodeQL - -on: - push: - branches: - - main - pull_request: - branches: - - main - schedule: - # Run a full scan every Monday at 06:15 UTC. - - cron: "15 6 * * 1" - -permissions: - contents: read - security-events: write - -jobs: - analyze-rust: - name: Analyze Rust - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable - - - name: Cache Cargo build artifacts - uses: Swatinem/rust-cache@v2 - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: rust - # Category must match the slug reported by GitHub Default setup. - build-mode: manual - - - name: Build for CodeQL - run: cargo build --release - - - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v3 - with: - category: /language:rust - - analyze-actions: - name: Analyze GitHub Actions - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: actions - build-mode: none - - - name: Perform CodeQL analysis - uses: github/codeql-action/analyze@v3 - with: - category: /language:actions