From fb5fb377288d80e9b0380020b637d1da96778500 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Feb 2026 16:29:23 +0000 Subject: [PATCH 1/5] Initial plan From fa45dfea5404940ba6fb96a3702eb8b1a10ccb62 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Feb 2026 16:33:22 +0000 Subject: [PATCH 2/5] Add CodeQL workflow for security analysis Co-authored-by: harsha-simhadri <5590673+harsha-simhadri@users.noreply.github.com> --- .github/workflows/codeql.yml | 64 ++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..16b2f6397 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,64 @@ +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT license. + +name: "CodeQL" + +on: + push: + branches: ["main"] + pull_request: + branches: ["main"] + schedule: + - cron: '0 0 * * 1' # Run every Monday at midnight UTC + +permissions: + actions: read + contents: read + security-events: write + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: true + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + language: ['rust'] + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + # queries: security-extended,security-and-quality + + # Install Rust toolchain + - name: Install Rust + uses: dtolnay/rust-toolchain@stable + with: + toolchain: "1.92" + + - name: Setup Rust cache + uses: Swatinem/rust-cache@v2 + + # Build the Rust workspace + - name: Build workspace + run: cargo build --workspace --locked + + # Perform CodeQL Analysis + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" From 7d50f2f31a2d45c1db88be517a43ec85d71f2922 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Feb 2026 16:43:05 +0000 Subject: [PATCH 3/5] Move CodeQL analysis to ci.yml as pre-checkin validation Co-authored-by: arrayka <1551741+arrayka@users.noreply.github.com> --- .github/workflows/ci.yml | 30 +++++++++++++++++ .github/workflows/codeql.yml | 64 ------------------------------------ 2 files changed, 30 insertions(+), 64 deletions(-) delete mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f757eaf57..d7a3b546c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,6 +28,7 @@ defaults: permissions: contents: read + security-events: write jobs: # Basic checks that must pass before we kick off more expensive tests. @@ -38,6 +39,7 @@ jobs: - clippy - fmt - clippy-no-default-features + - codeql # TODO: Re-enable docs check later # - docs steps: @@ -125,6 +127,34 @@ jobs: --no-deps \ --config "$RUST_CONFIG" + codeql: + name: CodeQL security analysis + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: rust + + - name: Install Rust ${{ env.rust_stable }} + uses: dtolnay/rust-toolchain@stable + with: + toolchain: ${{ env.rust_stable }} + + - uses: Swatinem/rust-cache@v2 + + - name: Build workspace + run: cargo build --workspace --locked + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:rust" + # TODO: Re-enable docs check later # docs: # name: docs diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 16b2f6397..000000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,64 +0,0 @@ -# Copyright (c) Microsoft Corporation. All rights reserved. -# Licensed under the MIT license. - -name: "CodeQL" - -on: - push: - branches: ["main"] - pull_request: - branches: ["main"] - schedule: - - cron: '0 0 * * 1' # Run every Monday at midnight UTC - -permissions: - actions: read - contents: read - security-events: write - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} - cancel-in-progress: true - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - - strategy: - fail-fast: false - matrix: - language: ['rust'] - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - # queries: security-extended,security-and-quality - - # Install Rust toolchain - - name: Install Rust - uses: dtolnay/rust-toolchain@stable - with: - toolchain: "1.92" - - - name: Setup Rust cache - uses: Swatinem/rust-cache@v2 - - # Build the Rust workspace - - name: Build workspace - run: cargo build --workspace --locked - - # Perform CodeQL Analysis - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:${{matrix.language}}" From cbdbb77cdbed53979e1f9ed0c91eb166c038fb26 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Feb 2026 23:51:53 +0000 Subject: [PATCH 4/5] Fix CodeQL job: scope permissions, fix indentation, use ci profile Co-authored-by: hildebrandmw <24898651+hildebrandmw@users.noreply.github.com> --- .github/workflows/ci.yml | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d7a3b546c..24d42e623 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,7 +28,6 @@ defaults: permissions: contents: read - security-events: write jobs: # Basic checks that must pass before we kick off more expensive tests. @@ -130,30 +129,33 @@ jobs: codeql: name: CodeQL security analysis runs-on: ubuntu-latest + permissions: + contents: read + security-events: write steps: - - name: Checkout repository - uses: actions/checkout@v4 + - name: Checkout repository + uses: actions/checkout@v4 - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: rust + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: rust - - name: Install Rust ${{ env.rust_stable }} - uses: dtolnay/rust-toolchain@stable - with: - toolchain: ${{ env.rust_stable }} + - name: Install Rust ${{ env.rust_stable }} + uses: dtolnay/rust-toolchain@stable + with: + toolchain: ${{ env.rust_stable }} - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@v2 - - name: Build workspace - run: cargo build --workspace --locked + - name: Build workspace + run: cargo build --workspace --locked --profile ci - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:rust" + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:rust" # TODO: Re-enable docs check later # docs: From 18d2d4c594d5347aa61869ba87798b3116801f97 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 11 Feb 2026 00:04:49 +0000 Subject: [PATCH 5/5] Remove CodeQL from basics gate to avoid blocking expensive tests Co-authored-by: hildebrandmw <24898651+hildebrandmw@users.noreply.github.com> --- .github/workflows/ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 24d42e623..f3e5bafb4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,7 +38,6 @@ jobs: - clippy - fmt - clippy-no-default-features - - codeql # TODO: Re-enable docs check later # - docs steps: