Skip to content

ci: add CodeQL security analysis workflow (#63648) - #67970

Closed
saidai-bhuvanesh wants to merge 1 commit into
SAPTARSHI-coder:mainfrom
saidai-bhuvanesh:ci/codeql-analysis-63648
Closed

ci: add CodeQL security analysis workflow (#63648)#67970
saidai-bhuvanesh wants to merge 1 commit into
SAPTARSHI-coder:mainfrom
saidai-bhuvanesh:ci/codeql-analysis-63648

Conversation

@saidai-bhuvanesh

@saidai-bhuvanesh saidai-bhuvanesh commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

What

Closes #63648 — adds a CodeQL static analysis workflow for automated security/code-quality scanning.

Workflow: .github/workflows/codeql.yml

Triggers (per the issue's spec)

  • Push to main
  • Pull requests targeting main
  • Weekly schedule (Monday 02:00 UTC)
  • Manual workflow_dispatch

What it does

  1. github/codeql-action/init@v3 — initializes CodeQL for JavaScript (EaseMotion-css ships JS: build scripts, the motion engine, benchmarks) using the security-and-quality query suite for richer findings.
  2. github/codeql-action/autobuild@v3 — builds the analysis target automatically (no custom build step needed; the repo's JS is interpreted).
  3. github/codeql-action/analyze@v3 — runs the queries and uploads SARIF results to GitHub Security → Code scanning, categorized as /language:javascript.

Permissions — least-privilege, scoped exactly to what CodeQL needs:

  • contents: read — checkout
  • security-events: write — upload SARIF to Code scanning
  • actions: read — required by the upload-sarif action

Concurrency — codeql-${{ github.ref }}, cancel-in-progress: true so superseded runs on the same branch are cancelled (saves Actions minutes).

Timeout — 30 min safety cap.

Acceptance criteria (from the issue)

  • ✅ New workflow at .github/workflows/codeql.yml
  • ✅ Triggers: push to main, PRs, weekly schedule
  • ✅ Uses GitHub's official CodeQL Action (@v3)
  • ✅ Initializes the appropriate language (JavaScript)
  • ✅ Performs analysis after the build step (autobuild)
  • ✅ Uploads results to GitHub Security → Code scanning
  • ✅ Configured workflow permissions (least-privilege)

Verification

  • YAML validated locally (parses cleanly; triggers, permissions, matrix, steps all structurally correct).
  • No new runtime dependencies; no package.json or framework source changes.

Duplicate issue note

#63649 is a byte-for-byte identical duplicate of this issue (same title and body). This PR resolves the underlying request; I'll close #63649 as a duplicate once this is reviewed.

Notes

  • Additive only — a single new workflow file.

@github-actions github-actions Bot added good first issue Good for newcomers GSSoC-26 Official GSSoC 2026 issue gssoc:approved Approved for GSSoC contributions help wanted Extra attention needed level:intermediate Requires moderate project understanding type:feature New functionality or enhancement labels Aug 9, 2026
@SAPTARSHI-coder SAPTARSHI-coder added the invalid This doesn't seem right label Aug 9, 2026
@SAPTARSHI-coder

SAPTARSHI-coder commented Aug 9, 2026

Copy link
Copy Markdown
Owner

❌ PR Closed — Files Outside submissions/ Folder

@saidai-bhuvanesh, this PR has been automatically closed because it modifies files outside the allowed submissions/ directory:

  • .github/workflows/codeql.yml

What to do

Contributions must only add files inside the submissions/ folder. Please:

  1. Create a new branch
  2. Add only your submission files under submissions/examples/your-feature-name/
  3. Open a new PR

See the contribution guide for details.

— EaseMotion CSS Guard

@saidai-bhuvanesh saidai-bhuvanesh mentioned this pull request Aug 9, 2026
Closed
@SAPTARSHI-coder

SAPTARSHI-coder commented Aug 9, 2026

Copy link
Copy Markdown
Owner

🔒 Pull Request Closed: This PR has been automatically closed because it does not contain any file changes under the submissions/ directory. Contributors must place their submissions under the submissions/ directory (e.g., submissions/examples/your-feature-name/ or submissions/docs/your-feature-name/). Thank you!

@SAPTARSHI-coder

SAPTARSHI-coder commented Aug 9, 2026

Copy link
Copy Markdown
Owner

❌ Submission Validation Failed

Thank you for your contribution! However, some required files are missing or incorrect.

📋 Required Structure

submissions/your-category/your-feature-name/ (e.g., submissions/examples/ or submissions/docs/)
├── demo.html     ← Interactive demo with DOCTYPE, html, head, body tags
├── style.css     ← Your original CSS (not copy-pasted from a template)
└── README.md     ← Brief description of your feature

🔍 Issues Found:

🔠 Core Framework Protection

  • ❌ PR modifies core framework/configuration files: .github/workflows/codeql.yml. Contributors may only modify files inside the submissions/ directory.

🔠 Submission Folder Protection

  • ❌ This PR does not contain any additions inside the submissions/ directory. Contributors must place their submissions under the submissions/ directory (e.g. submissions/examples/your-feature-name/ or submissions/docs/your-feature-name/).

📝 How to Fix:

  1. Ensure all 3 files exist with real, original content
  2. demo.html must have <!DOCTYPE html>, <html>, <head>, <body> tags
  3. style.css must contain your own CSS (not copy-pasted boilerplate)
  4. Push fixes to this branch — the validator will re-run automatically

📖 See CONTRIBUTING.md for full guidelines.

@SAPTARSHI-coder

SAPTARSHI-coder commented Aug 9, 2026

Copy link
Copy Markdown
Owner

🔒 Pull Request Closed

This PR was automatically closed because it failed the submission validation check.

Please fix the issues listed above, then open a new pull request. Thank you!

@SAPTARSHI-coder SAPTARSHI-coder added accepted Contribution approved for integration into EaseMotion CSS good-pr integrated Successfully merged and included in the framework level:advanced Complex issue requiring deep understanding and removed invalid This doesn't seem right labels Aug 11, 2026
@SAPTARSHI-coder

SAPTARSHI-coder commented Aug 11, 2026

Copy link
Copy Markdown
Owner

🔒 Pull Request Closed: This PR has been automatically closed because it does not contain any file changes under the submissions/ directory. Contributors must place their submissions under the submissions/ directory (e.g., submissions/examples/your-feature-name/ or submissions/docs/your-feature-name/). Thank you!

@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

✅ PR Closed — Full GSSoC Credit Awarded. Thanks @saidai-bhuvanesh! You have submitted 51/250 PRs today (resets in 5h). Labels: GSSoC-26, gssoc:approved, accepted, integrated, good-pr assigned.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SAPTARSHI-coder SAPTARSHI-coder Awaiting requested review from SAPTARSHI-coder SAPTARSHI-coder is a code owner

Assignees

@saidai-bhuvanesh saidai-bhuvanesh

@SAPTARSHI-coder SAPTARSHI-coder

Labels

accepted Contribution approved for integration into EaseMotion CSS good first issue Good for newcomers good-pr gssoc:approved Approved for GSSoC contributions GSSoC-26 Official GSSoC 2026 issue help wanted Extra attention needed integrated Successfully merged and included in the framework level:advanced Complex issue requiring deep understanding level:intermediate Requires moderate project understanding needs-files type:feature New functionality or enhancement

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ci: Add CodeQL security analysis workflow for automated code scanning ci: Add CodeQL security analysis workflow for automated code scanning

3 participants

@saidai-bhuvanesh @SAPTARSHI-coder @openhands-agent