-
Notifications
You must be signed in to change notification settings - Fork 12
Improve codeql action #78
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
fbcf205
9f170d8
45824b0
5eeeaea
c8d3c0a
f4f26c2
0365c39
ba293d4
622e337
5f1e2a6
1af0718
2aba1a9
971952e
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -32,8 +32,13 @@ jobs: | |||||
| with: | ||||||
| submodules: recursive | ||||||
|
|
||||||
| - name: Install nightly toolchain | ||||||
| run: | | ||||||
| rustup toolchain install nightly --profile minimal | ||||||
| rustup component add rustfmt --toolchain nightly | ||||||
|
|
||||||
| - name: Run rustfmt | ||||||
| run: cargo fmt --all --check | ||||||
| run: cargo +nightly fmt --all --check | ||||||
|
|
||||||
| clippy: | ||||||
| name: Clippy Check | ||||||
|
|
@@ -43,6 +48,7 @@ jobs: | |||||
| pull-requests: write | ||||||
| env: | ||||||
| CARGO_TERM_COLOR: always | ||||||
| RUSTUP_TOOLCHAIN: stable | ||||||
|
|
||||||
| steps: | ||||||
| - name: Checkout repository | ||||||
|
|
@@ -51,12 +57,16 @@ jobs: | |||||
| submodules: recursive | ||||||
|
|
||||||
| - name: Run cargo clippy | ||||||
| run: cargo clippy -- -D warnings | ||||||
| run: cargo clippy --all-targets --all-features -- -D warnings | ||||||
|
|
||||||
| redundancy: | ||||||
| name: Redundancy Check | ||||||
| runs-on: [ self-hosted ] | ||||||
|
|
||||||
| env: | ||||||
| CARGO_TERM_COLOR: always | ||||||
| RUSTUP_TOOLCHAIN: stable | ||||||
|
|
||||||
| steps: | ||||||
| - name: Checkout repository | ||||||
| uses: actions/checkout@v4 | ||||||
|
|
@@ -82,6 +92,10 @@ jobs: | |||||
|
|
||||||
| runs-on: [ self-hosted ] | ||||||
|
|
||||||
| env: | ||||||
| CARGO_TERM_COLOR: always | ||||||
| RUSTUP_TOOLCHAIN: stable | ||||||
|
|
||||||
| steps: | ||||||
| - name: Checkout repository | ||||||
| uses: actions/checkout@v4 | ||||||
|
|
@@ -97,6 +111,7 @@ jobs: | |||||
| runs-on: [ self-hosted ] | ||||||
| env: | ||||||
| CARGO_TERM_COLOR: always | ||||||
| RUSTUP_TOOLCHAIN: stable | ||||||
|
|
||||||
| steps: | ||||||
| - name: Checkout repository | ||||||
|
|
@@ -106,4 +121,4 @@ jobs: | |||||
| lfs: true | ||||||
|
|
||||||
| - name: Run cargo test | ||||||
| run: git lfs pull && cargo test --all | ||||||
| run: git lfs pull && cargo test --all | ||||||
|
||||||
| run: git lfs pull && cargo test --all | |
| run: git lfs pull && cargo test --all |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -138,7 +138,6 @@ jobs: | |
|
|
||
| # Enable progress tracking and show full Claude output in logs | ||
| track_progress: true | ||
| show_full_output: true | ||
|
|
||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Intentional removal - Removing This change reduces log verbosity. The parameter was likely removed because:
✅ This is a reasonable default unless debugging is needed. |
||
| # Custom review instructions passed to Claude | ||
| prompt: | | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -16,8 +16,6 @@ on: | |
| branches: [ "main" ] | ||
| pull_request: | ||
| branches: [ "main" ] | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Excellent simplification - Removing ✅ Benefits:
This aligns with best practices for PR-focused security scanning. |
||
| schedule: | ||
| - cron: '22 5 * * 4' | ||
|
|
||
| jobs: | ||
| analyze: | ||
|
|
@@ -27,7 +25,7 @@ jobs: | |
| # - https://gh.io/supported-runners-and-hardware-resources | ||
| # - https://gh.io/using-larger-runners (GitHub.com only) | ||
| # Consider using larger runners or machines with greater resources for possible analysis time improvements. | ||
| runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} | ||
| runs-on: 'ubuntu-latest' | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Good simplification - Removing the Swift/macOS conditional: ✅ Benefits:
Original: |
||
| permissions: | ||
| # required for all workflows | ||
| security-events: write | ||
|
|
@@ -47,14 +45,6 @@ jobs: | |
| build-mode: none | ||
| - language: rust | ||
| build-mode: none | ||
| # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' | ||
| # Use `c-cpp` to analyze code written in C, C++ or both | ||
| # Use 'java-kotlin' to analyze code written in Java, Kotlin or both | ||
| # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both | ||
| # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, | ||
| # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. | ||
| # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how | ||
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
@@ -78,23 +68,6 @@ jobs: | |
| # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs | ||
| # queries: security-extended,security-and-quality | ||
|
|
||
| # If the analyze step fails for one of the languages you are analyzing with | ||
| # "We were unable to automatically build your code", modify the matrix above | ||
| # to set the build mode to "manual" for that language. Then modify this step | ||
| # to build your code. | ||
| # ℹ️ Command-line programs to run using the OS shell. | ||
| # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun | ||
| - name: Run manual build steps | ||
| if: matrix.build-mode == 'manual' | ||
| shell: bash | ||
| run: | | ||
| echo 'If you are using a "manual" build mode for one or more of the' \ | ||
| 'languages you are analyzing, replace this with the commands to build' \ | ||
| 'your code, for example:' | ||
| echo ' make bootstrap' | ||
| echo ' make release' | ||
| exit 1 | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v4 | ||
|
Comment on lines
48
to
72
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Excellent cleanup - Removing the manual build step section: ✅ Benefits:
This is a significant improvement in workflow readability. |
||
| with: | ||
|
|
||
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
| @@ -1,6 +1,6 @@ | ||||||||
| [package] | ||||||||
| name = "git-internal" | ||||||||
| version = "0.4.0" | ||||||||
| version = "0.4.1" | ||||||||
| edition = "2024" | ||||||||
| license = "MIT" | ||||||||
| description = "Git-Internal is a high-performance Rust library for encoding and decoding Git internal objects and Pack files." | ||||||||
|
|
@@ -28,7 +28,7 @@ encoding_rs = "0.8.35" | |||||||
| rayon = "1.11.0" | ||||||||
| ahash = "0.8.12" | ||||||||
| diffs = "0.5.1" | ||||||||
| libc = "0.2.179" | ||||||||
| libc = "0.2.180" | ||||||||
| async-trait = "0.1.89" | ||||||||
| futures = "0.3.31" | ||||||||
| tokio-stream = "0.1.18" | ||||||||
|
|
@@ -40,9 +40,9 @@ sha2 = "0.10.9" | |||||||
| crc32fast = "1.4" | ||||||||
|
||||||||
| crc32fast = "1.4" | |
| crc32fast = "1.4" | |
| # zstd-sys 2.0.16 corresponds to bundled zstd 1.5.7 (previously encoded as +zstd.1.5.7) |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -151,3 +151,55 @@ A simple approach: | |
| ### Benchmark | ||
|
|
||
| **TODO** | ||
|
|
||
| ## Contributing | ||
|
|
||
| ### Pre-submission Checks | ||
|
|
||
| Before submitting a Pull Request, please ensure your code passes the following checks: | ||
|
|
||
| ```bash | ||
| # Run clippy with all warnings treated as errors (warnings will be treated as errors) | ||
| cargo clippy --all-targets --all-features -- -D warnings | ||
|
||
|
|
||
| # Check code formatting (requires nightly toolchain) | ||
| cargo +nightly fmt --all --check | ||
| ``` | ||
|
|
||
| **Both commands must complete without any warnings.** The clippy check treats all warnings as errors, and the formatter check ensures code follows the project style guide. Only PRs that pass these checks will be accepted for merge. | ||
|
|
||
| If the formatting check fails, you can automatically fix formatting issues by running: | ||
|
|
||
| ```bash | ||
| cargo +nightly fmt --all | ||
| ``` | ||
|
|
||
| ### Buck2 Build Requirements | ||
|
|
||
| This project builds with Buck2. Please install both Buck2 and `cargo-buckal` before development: | ||
|
|
||
| ```bash | ||
| # Install buck2: download the latest release tarball from | ||
| # https://github.com/facebook/buck2/releases, extract the binary, | ||
| # and place it in ~/.cargo/bin (ensure ~/.cargo/bin is on PATH). | ||
| # Example (replace <tag> and <platform> with the latest for your OS): | ||
| wget https://github.com/facebook/buck2/releases/download/<tag>/buck2-<platform>.tar.gz | ||
| tar -xzf buck2-<platform>.tar.gz | ||
| mv buck2 ~/.cargo/bin/ | ||
|
|
||
| # Install cargo-buckal (requires Rust toolchain) | ||
| cargo install --git https://github.com/buck2hub/cargo-buckal.git | ||
| ``` | ||
|
|
||
| Pull Requests must also pass the Buck2 build: | ||
|
|
||
| ```bash | ||
| cargo buckal build | ||
| ``` | ||
|
|
||
| When you update dependencies in Cargo.toml, regenerate Buck metadata and third-party lockfiles: | ||
|
|
||
| ```bash | ||
| cargo buckal migrate | ||
| ``` | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The clippy command now includes
--all-targetswhich will check tests, benches, examples, and all other targets. This is good for comprehensive coverage, but be aware it may catch issues in code that wasn't previously checked. Consider mentioning this expanded scope in the PR description to set expectations.