CodeQL: scan python and actions alongside javascript-typescript - #82
Merged
Conversation
GitHub detects python and actions code in this repo, but the analysis only covered javascript-typescript, so the apprise-runner script and all seven workflow files were never scanned. Convert the job to a matrix so each language gets its own analysis and SARIF category. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
CodeQL has been running reliably on this repo (last analysis 2026-07-29, weekly cron every Monday), but it only ever analysed
javascript-typescript.GitHub's language detection for this repo reports
actions,javascript,javascript-typescript,python, andtypescript. That leaves two things unscanned:src/worker/external-notifications/apprise-runner.py.github/workflows/The
actionspack is not hypothetical — it's what surfaced aactions/missing-workflow-permissionsalert inkopage-docker, and this repo has considerably more workflow surface.Change
Converts the single job into a matrix over
javascript-typescript,python, andactions. Each language gets its own analysis and its own SARIFcategory, which is what keeps the three result sets from overwriting each other in the Security tab.fail-fast: falseso one language failing doesn't cancel the others' uploads. Triggers,security-extendedsuite, and action versions are unchanged.Notes
Expect the first run to open some
actionsalerts — most likely missing top-levelpermissions:blocks on the workflows that don't declare them.