From bca97d3d8b1d978e7a4a4b63bfffab7e11753867 Mon Sep 17 00:00:00 2001 From: Oleg Ovcharuk Date: Mon, 5 Oct 2026 18:10:22 +0300 Subject: [PATCH 1/3] ci: standardize CodeQL security analysis --- .github/codeql/README.md | 9 +++++++ .github/codeql/actions.yml | 4 +++ .github/codeql/sdk.yml | 14 ++++++++++ .github/workflows/codeql.yml | 52 ++++++++++++++++++++++++++++++++++++ 4 files changed, 79 insertions(+) create mode 100644 .github/codeql/README.md create mode 100644 .github/codeql/actions.yml create mode 100644 .github/codeql/sdk.yml create mode 100644 .github/workflows/codeql.yml diff --git a/.github/codeql/README.md b/.github/codeql/README.md new file mode 100644 index 00000000..02098015 --- /dev/null +++ b/.github/codeql/README.md @@ -0,0 +1,9 @@ +# Security analysis + +The CodeQL workflow runs the `security-extended` query suite for the SDK language and GitHub Actions on pull requests, pushes, merge queues and a weekly schedule. It can also be started manually. + +The SDK scan includes sync/async clients, examples, release scripts and package setup. Generated protobuf stubs and unit-test files are excluded. + +Results are published to **Security and quality → Code scanning**, with a separate category for each language. Review initial findings and record a reason for every dismissed alert. + +After merging, configure a branch ruleset with **Require code scanning results → CodeQL → Security alerts: High or higher** for supported branches. Successful workflow execution alone does not enforce this threshold. Track the latest analysis commit/date, extraction errors and open findings by security severity. diff --git a/.github/codeql/actions.yml b/.github/codeql/actions.yml new file mode 100644 index 00000000..57959b9d --- /dev/null +++ b/.github/codeql/actions.yml @@ -0,0 +1,4 @@ +name: GitHub Actions security baseline + +queries: + - uses: security-extended diff --git a/.github/codeql/sdk.yml b/.github/codeql/sdk.yml new file mode 100644 index 00000000..545124fc --- /dev/null +++ b/.github/codeql/sdk.yml @@ -0,0 +1,14 @@ +name: SDK security baseline + +queries: + - uses: security-extended + +paths: + - "ydb" + - "examples" + - ".github/scripts" + - "setup.py" + +paths-ignore: + - "ydb/_grpc/**" + - "**/*_test.py" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..ed1ed712 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,52 @@ +name: CodeQL + +on: + push: + branches: ["main"] + pull_request: + branches: ["main"] + merge_group: + schedule: + - cron: '23 3 * * 1' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: codeql-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + analyze: + name: CodeQL (${{ matrix.language }}) + runs-on: ubuntu-24.04 + timeout-minutes: 45 + permissions: + contents: read + security-events: write + strategy: + fail-fast: false + matrix: + include: + - language: python + build-mode: none + config: .github/codeql/sdk.yml + - language: actions + build-mode: none + config: .github/codeql/actions.yml + steps: + - name: Checkout + uses: actions/checkout@v6 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v4 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + config-file: ${{ matrix.config }} + + - name: Analyze and upload results + uses: github/codeql-action/analyze@v4 + with: + category: /language:${{ matrix.language }} From 9010829d10450027668f861d8f8ce40b91567e47 Mon Sep 17 00:00:00 2001 From: Oleg Ovcharuk Date: Mon, 5 Oct 2026 18:17:42 +0300 Subject: [PATCH 2/3] docs: require complete CodeQL analysis --- .github/codeql/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/codeql/README.md b/.github/codeql/README.md index 02098015..e47fb0e7 100644 --- a/.github/codeql/README.md +++ b/.github/codeql/README.md @@ -6,4 +6,4 @@ The SDK scan includes sync/async clients, examples, release scripts and package Results are published to **Security and quality → Code scanning**, with a separate category for each language. Review initial findings and record a reason for every dismissed alert. -After merging, configure a branch ruleset with **Require code scanning results → CodeQL → Security alerts: High or higher** for supported branches. Successful workflow execution alone does not enforce this threshold. Track the latest analysis commit/date, extraction errors and open findings by security severity. +After merging, require both **CodeQL (python)** and **CodeQL (actions)** job checks for supported branches. Also enable **Require code scanning results → CodeQL → Security alerts: High or higher** in the branch ruleset. Successful workflow execution alone does not enforce this threshold. Track the latest analysis commit/date, extraction errors and open findings by security severity. From 0c21dddf437a88ca95f95e0a37dfb5cd816098f4 Mon Sep 17 00:00:00 2001 From: Oleg Ovcharuk Date: Mon, 5 Oct 2026 18:24:19 +0300 Subject: [PATCH 3/3] ci: scan Python package files from repository root --- .github/codeql/README.md | 2 +- .github/codeql/sdk.yml | 7 +------ 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/.github/codeql/README.md b/.github/codeql/README.md index e47fb0e7..7bb9c880 100644 --- a/.github/codeql/README.md +++ b/.github/codeql/README.md @@ -2,7 +2,7 @@ The CodeQL workflow runs the `security-extended` query suite for the SDK language and GitHub Actions on pull requests, pushes, merge queues and a weekly schedule. It can also be started manually. -The SDK scan includes sync/async clients, examples, release scripts and package setup. Generated protobuf stubs and unit-test files are excluded. +The SDK scan includes sync/async clients, examples, release scripts and package setup. Generated protobuf stubs and test fixtures are excluded. Results are published to **Security and quality → Code scanning**, with a separate category for each language. Review initial findings and record a reason for every dismissed alert. diff --git a/.github/codeql/sdk.yml b/.github/codeql/sdk.yml index 545124fc..d5a283af 100644 --- a/.github/codeql/sdk.yml +++ b/.github/codeql/sdk.yml @@ -3,12 +3,7 @@ name: SDK security baseline queries: - uses: security-extended -paths: - - "ydb" - - "examples" - - ".github/scripts" - - "setup.py" - paths-ignore: - "ydb/_grpc/**" + - "tests/**" - "**/*_test.py"