Update CodeQL workflow to v4 and replace deprecated LGTM badges#1079
Merged
Conversation
Reviewer's GuideAdds a new GitHub Actions CodeQL v4 workflow for JavaScript analysis and replaces deprecated LGTM badges in the README with a CodeQL status badge referencing the new workflow. Flow diagram for CodeQL analyze job stepsflowchart TD
Trigger[Workflow triggered
push, pull_request, or schedule]
AnalyzeJob[Job analyze
runs-on ubuntu-latest]
Checkout[Step Checkout repository
actions/checkout@v4]
InitCodeQL[Step Initialize CodeQL
github/codeql-action/init@v4]
Autobuild[Step Autobuild
github/codeql-action/autobuild@v4]
Analyze[Step Perform CodeQL Analysis
github/codeql-action/analyze@v4]
Results[Upload security-events
to code scanning]
Trigger --> AnalyzeJob
AnalyzeJob --> Checkout
Checkout --> InitCodeQL
InitCodeQL --> Autobuild
Autobuild --> Analyze
Analyze --> Results
subgraph Matrix
LangJS[language javascript]
end
AnalyzeJob --> LangJS
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location> `.github/workflows/codeql.yml:27-28` </location>
<code_context>
+ language: [ 'javascript' ]
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+
+ - name: Initialize CodeQL
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Pin actions to a specific commit SHA instead of a floating major tag for better supply-chain security
Floating tags like `@v4` will auto-upgrade to new major versions, which can change behavior without review. For security-sensitive workflows like CodeQL, please pin actions (e.g. `actions/checkout`, `github/codeql-action`) to specific commit SHAs, optionally with a comment noting the version, so updates are explicit and reviewable.
Suggested implementation:
```
- name: Checkout repository
# actions/checkout v4.x
uses: actions/checkout@<COMMIT-SHA-FOR-ACTIONS-CHECKOUT-V4>
```
```
- name: Initialize CodeQL
# github/codeql-action/init v4.x
uses: github/codeql-action/init@<COMMIT-SHA-FOR-CODEQL-ACTION-V4>
with:
languages: ${{ matrix.language }}
```
```
- name: Autobuild
# github/codeql-action/autobuild v4.x
uses: github/codeql-action/autobuild@<COMMIT-SHA-FOR-CODEQL-ACTION-V4>
```
```
- name: Perform CodeQL Analysis
# github/codeql-action/analyze v4.x
uses: github/codeql-action/analyze@<COMMIT-SHA-FOR-CODEQL-ACTION-V4>
```
1. Replace `<COMMIT-SHA-FOR-ACTIONS-CHECKOUT-V4>` with the actual commit SHA for the desired `actions/checkout` v4 release (from https://github.com/actions/checkout/tags or the GitHub Marketplace).
2. Replace `<COMMIT-SHA-FOR-CODEQL-ACTION-V4>` with the actual commit SHA for the desired `github/codeql-action` v4 release (from https://github.com/github/codeql-action/tags). The same SHA is typically used for `init`, `autobuild`, and `analyze`.
3. Optionally, refine the comments to specify the exact version (e.g. `v4.2.2`) corresponding to the chosen SHAs for clearer auditing.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+27
to
+28
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🚨 suggestion (security): Pin actions to a specific commit SHA instead of a floating major tag for better supply-chain security
Floating tags like @v4 will auto-upgrade to new major versions, which can change behavior without review. For security-sensitive workflows like CodeQL, please pin actions (e.g. actions/checkout, github/codeql-action) to specific commit SHAs, optionally with a comment noting the version, so updates are explicit and reviewable.
Suggested implementation:
- name: Checkout repository
# actions/checkout v4.x
uses: actions/checkout@<COMMIT-SHA-FOR-ACTIONS-CHECKOUT-V4>
- name: Initialize CodeQL
# github/codeql-action/init v4.x
uses: github/codeql-action/init@<COMMIT-SHA-FOR-CODEQL-ACTION-V4>
with:
languages: ${{ matrix.language }}
- name: Autobuild
# github/codeql-action/autobuild v4.x
uses: github/codeql-action/autobuild@<COMMIT-SHA-FOR-CODEQL-ACTION-V4>
- name: Perform CodeQL Analysis
# github/codeql-action/analyze v4.x
uses: github/codeql-action/analyze@<COMMIT-SHA-FOR-CODEQL-ACTION-V4>
- Replace
<COMMIT-SHA-FOR-ACTIONS-CHECKOUT-V4>with the actual commit SHA for the desiredactions/checkoutv4 release (from https://github.com/actions/checkout/tags or the GitHub Marketplace). - Replace
<COMMIT-SHA-FOR-CODEQL-ACTION-V4>with the actual commit SHA for the desiredgithub/codeql-actionv4 release (from https://github.com/github/codeql-action/tags). The same SHA is typically used forinit,autobuild, andanalyze. - Optionally, refine the comments to specify the exact version (e.g.
v4.2.2) corresponding to the chosen SHAs for clearer auditing.
jfhenon
approved these changes
Jan 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR description
The LGTM service has been discontinued, so the old LGTM badges in the README are broken.
This PR does the following:
After merging, the badge will show the status of CodeQL analysis for the repository.
Checklist
Summary by Sourcery
Add GitHub CodeQL security analysis and update README badges to reflect the new workflow.
New Features:
Enhancements:
CI: