mirror of
https://github.com/Second-Hand-Friends/kleinanzeigen-bot.git
synced 2026-03-12 02:31:45 +01:00
efede9a5a2
## ℹ️ Description This PR resolves all open CodeQL security warnings by implementing recommended security best practices for GitHub Actions workflows and addressing code analysis findings. **Related**: Resolves CodeQL alerts 37-53 **Motivation**: CodeQL identified 17 security warnings across our workflows and Python code. These warnings highlight potential supply chain security risks (unpinned actions), missing security boundaries (workflow permissions), and false positives that needed proper documentation. ## 📋 Changes Summary ### Security Hardening - **Pinned all GitHub Actions to commit SHAs** (26 action references across 5 workflows) - Added version comments for maintainability (e.g., `@8e8c483... # v6.0.0`) - Dependabot will now auto-update these pinned SHAs securely ### Workflow Permissions - Added explicit `permissions` block to `update-python-deps.yml` workflow - Added explicit `permissions: contents: read` to `publish-coverage` job in `build.yml` - Follows principle of least privilege ### Dependabot Configuration - Enhanced `.github/dependabot.yml` with action update grouping (single PR instead of multiple) - Added `rebase-strategy: auto` for automatic conflict resolution ### Code Quality - Added CodeQL suppression with detailed explanation in `src/kleinanzeigen_bot/utils/reflect.py` - Documented why explicit `del stack` is necessary for frame cleanup (prevents false positive) ### ⚙️ Type of Change - [x] 🐞 Bug fix (non-breaking change which fixes an issue) - [ ] ✨ New feature (adds new functionality without breaking existing usage) - [ ] 💥 Breaking change (changes that might break existing user setups, scripts, or configurations) ## ✅ Checklist - [x] I have reviewed my changes to ensure they meet the project's standards. - [x] I have tested my changes and ensured that all tests pass (`pdm run test`). - [x] I have formatted the code (`pdm run format`). - [x] I have verified that linting passes (`pdm run lint`). - [x] I have updated documentation where necessary. By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * CI workflows: pinned external actions to specific commits for reproducible runs and added explicit permission scopes where required. * Dependabot: grouped GitHub Actions updates into a single consolidated group for unified updates and auto-rebasing. * **Documentation** * Expanded internal comments clarifying cleanup logic to reduce potential reference-cycle concerns. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
107 lines
3.2 KiB
YAML
107 lines
3.2 KiB
YAML
# SPDX-FileCopyrightText: © Sebastian Thomschke and contributors
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
# SPDX-ArtifactOfProjectHomePage: https://github.com/Second-Hand-Friends/kleinanzeigen-bot
|
|
#
|
|
# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning
|
|
name: "CodeQL"
|
|
|
|
on: # https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
|
|
schedule:
|
|
# https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#schedule
|
|
- cron: '10 10 * * 1' # Mondays 10:10 UTC
|
|
push:
|
|
branches: ['**'] # build all branches
|
|
tags-ignore: ['**'] # don't build tags
|
|
paths-ignore:
|
|
- '**/*.md'
|
|
- '.act*'
|
|
- '.editorconfig'
|
|
- '.git*'
|
|
- 'codecov.yml'
|
|
pull_request:
|
|
paths-ignore:
|
|
- '**/*.md'
|
|
- '.act*'
|
|
- '.editorconfig'
|
|
- '.git*'
|
|
- 'codecov.yml'
|
|
workflow_dispatch:
|
|
# https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#workflow_dispatch
|
|
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
env:
|
|
PYTHON_VERSION: "3.14"
|
|
|
|
jobs:
|
|
|
|
###########################################################
|
|
analyze:
|
|
###########################################################
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
permissions:
|
|
# required for all workflows
|
|
security-events: write
|
|
|
|
# required to fetch internal or private CodeQL packs
|
|
packages: read
|
|
|
|
# only required for workflows in private repositories
|
|
actions: read
|
|
contents: read
|
|
|
|
steps:
|
|
- name: "Show: GitHub context"
|
|
env:
|
|
GITHUB_CONTEXT: ${{ toJSON(github) }}
|
|
run: printf '%s' "$GITHUB_CONTEXT" | python -m json.tool
|
|
|
|
|
|
- name: "Show: environment variables"
|
|
run: env | sort
|
|
|
|
|
|
- name: Git Checkout
|
|
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.0
|
|
# https://github.com/actions/checkout
|
|
|
|
|
|
- name: "Install: Python and PDM" # https://github.com/pdm-project/setup-pdm
|
|
uses: pdm-project/setup-pdm@9e87bfc944c539be61c7653113bdb80ea5fe09d6 # v4.4
|
|
with:
|
|
python-version: "${{ env.PYTHON_VERSION }}"
|
|
cache: true
|
|
|
|
|
|
- name: "Install: Python dependencies"
|
|
run: |
|
|
set -eux
|
|
|
|
python --version
|
|
python -m pip install --upgrade pip
|
|
pip install --upgrade pdm
|
|
if [[ ! -e .venv ]]; then
|
|
pdm venv create || true
|
|
fi
|
|
pdm sync --clean -v
|
|
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@36a9c375704a9813bd709881c97694bcd24e1cb1 # v4.0.0
|
|
# https://github.com/github/codeql-action/blob/main/init/action.yml
|
|
with:
|
|
languages: actions,python
|
|
# https://github.com/github/codeql-action#build-modes
|
|
build-mode: none
|
|
# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#using-queries-in-ql-packs
|
|
queries: security-and-quality
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@36a9c375704a9813bd709881c97694bcd24e1cb1 # v4.0.0
|
|
# https://github.com/github/codeql-action
|