Skip to content

ci: establish enterprise GitHub Actions automation baseline #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CoreyLeath-code merged 8 commits into from
Jul 24, 2026
Merged

ci: establish enterprise GitHub Actions automation baseline #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
8779d76
ci: add enterprise automation baseline
CoreyLeath-code Jul 23, 2026
5786c85
ci: add enterprise automation baseline
CoreyLeath-code Jul 23, 2026
d088a65
ci: add enterprise automation baseline
CoreyLeath-code Jul 23, 2026
ad6847c
ci: validate CodeQL language YAML
CoreyLeath-code Jul 24, 2026
fa7a6a7
ci: detect CodeQL languages per repository
CoreyLeath-code Jul 24, 2026
7992f5f
ci: harden CodeQL language detection
CoreyLeath-code Jul 24, 2026
56f9181
ci: fix CodeQL language JSON generation
CoreyLeath-code Jul 24, 2026
2e5ed81
ci: use no-build CodeQL extraction for SentinelAI C++ sources
CoreyLeath-code Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule: {interval: weekly}
open-pull-requests-limit: 10
45 changes: 45 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
name: CodeQL
on:
push:
pull_request:
schedule:
- cron: '23 3 * * 1'
permissions:
contents: read
security-events: write
jobs:
detect:
runs-on: ubuntu-latest
outputs:
languages: ${{ steps.lang.outputs.languages }}
steps:
- uses: actions/checkout@v4
- id: lang
shell: bash
run: |
set -euo pipefail
langs=''
[ -n "$(find . -name '*.py' -print -quit)" ] && langs="$langs python"
[ -n "$(find . -name '*.js' -print -quit)" ] || [ -n "$(find . -name '*.ts' -print -quit)" ] && langs="$langs javascript-typescript"
[ -f go.mod ] && langs="$langs go"
[ -f Cargo.toml ] && langs="$langs rust"
[ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin"
[ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp"
Comment on lines +24 to +27

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
actionlint .github/workflows/codeql.yml

Repository: CoreyLeath-code/SentinelAI

Length of output: 164

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== workflow relevant sections =="
sed -n '1,120p' .github/workflows/codeql.yml

echo
echo "== codeql action versions and uses =="
rg -n "github/codeql-action|analyze|initialize|action.yml|`@v`[0-9]" .github/workflows/codeql.yml

Repository: CoreyLeath-code/SentinelAI

Length of output: 1908

🌐 Web query:

github codeql-action initialize build-mode none Go Kotlin supported build-mode values

💡 Result:

The CodeQL Action does not support the build-mode: none value for either Go or Kotlin [1][2][3]. For compiled languages like Go and Kotlin, the CodeQL Action supports the following build modes: - autobuild: The CodeQL Action attempts to automatically build the source code [4][1]. - manual: You must specify manual build steps in your workflow between the init and analyze steps to build the source code [4][1][5]. While the build-mode: none option is available for certain languages where the database can be created without building the source code (such as interpreted languages and specific compiled languages like C/C++, C#, Java, and Rust), it is explicitly unsupported for Go and Kotlin [1][2][5][3]. If you attempt to use build-mode: none for these languages, the action will fail with an error [6].

Citations:

Use a build mode per detected language.

build-mode: none blocks CodeQL build setup for Go and Java/Kotlin; with only one build-mode input for the whole matrix, repos that include those languages either fail or miss database creation. Keep none for C/C++ no-build scans, but carry a build mode alongside each detected language, such as autobuild/manual for Go and Java/Kotlin, and pass it as ${{ matrix.build-mode }}.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/codeql.yml around lines 24 - 27, Update the
language-detection logic in the CodeQL workflow to associate each detected
language with its required build mode, retaining none for C/C++ and using an
appropriate build mode such as autobuild or manual for Go and Java/Kotlin.
Extend the matrix to include the per-language build mode and pass it through the
CodeQL initialization configuration as matrix.build-mode instead of a single
global none value.

Source: MCP tools

[ -n "$langs" ] || langs=' python'
json="$(jq -cn --arg l "$langs" '$l | split(" ") | map(select(length > 0))')"
echo "languages=$json" >> "$GITHUB_OUTPUT"
analyze:
needs: detect
strategy:
fail-fast: false
matrix:
language: ${{ fromJSON(needs.detect.outputs.languages) }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
build-mode: none

- uses: github/codeql-action/analyze@v3
9 changes: 9 additions & 0 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
name: Dependency Review
on: {pull_request:}

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
actionlint .github/workflows/dependency-review.yml

Repository: CoreyLeath-code/SentinelAI

Length of output: 461

Fix the invalid workflow trigger.

actionlint treats on: {pull_request:} as the unknown event pull_request: and will invalidate the workflow. Use the documented on: [pull_request] form.

Proposed fix 
-on: {pull_request:}
+on: [pull_request]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
on: {pull_request:}
on: [pull_request]
🧰 Tools
🪛 actionlint (1.7.12)

[error] 2-2: unknown Webhook event "pull_request:". see https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#webhook-events for list of all Webhook event names

(events)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependency-review.yml at line 2, Update the workflow’s on
trigger from the invalid pull_request mapping to the documented array form, on:
[pull_request], preserving the workflow’s pull request trigger behavior.

Sources: MCP tools, Linters/SAST tools

permissions: {contents: read, pull-requests: read}
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/dependency-review-action@v4
with: {fail-on-severity: high}
Loading