Skip to content
This repository has been archived by the owner on Nov 10, 2022. It is now read-only.

Add CodeQL Security Scan #75

Merged
merged 5 commits into from
May 25, 2021
Merged

Conversation

kxyr
Copy link

@kxyr kxyr commented May 20, 2021

Motivation

Follow up to issue open-telemetry/oteps#144

CodeQL is GitHub's static analysis engine which scans repos for security vulnerabilities. As the project grows and we near GA it might be useful to have a workflow which checks for security vulnerabilities with every PR so we can ensure every incremental change is following best development practices. Also passing basic security checks will also make sure that there aren't any glaring issues for our users.

Changes

This PR adds CodeQL security checks to the repo

  • After every run the workflow uploads the results to GitHub. Details on the run and security alerts will show up in the security tab of this repo.

Workflow Triggers

  • daily cron job at 1:30am
  • workflow_dispatch (in case maintainers want to trigger a security check manually)

cc- @alolita

@codecov
Copy link

codecov bot commented May 20, 2021

Codecov Report

Merging #75 (57d7b6c) into main (7f32567) will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##             main      #75   +/-   ##
=======================================
  Coverage   94.70%   94.70%           
=======================================
  Files          42       42           
  Lines         567      567           
  Branches       94       94           
=======================================
  Hits          537      537           
  Misses         30       30           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7f32567...57d7b6c. Read the comment docs.

Copy link
Member

@dyladan dyladan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good other than the modified changelog

CHANGELOG.md Outdated Show resolved Hide resolved
@naseemkullah
Copy link
Member

lgtm 🔐

Copy link
Member

@obecny obecny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@dyladan
Copy link
Member

dyladan commented May 24, 2021

Out of date branch and maintainers don't have permission to write to the source branch so I can't merge this until it is updated.

@kxyr
Copy link
Author

kxyr commented May 24, 2021

Rebased!

@vmarchaud
Copy link
Member

@xukaren Sorry but you will need to rebase again :/ Could you allow us to write on your fork so we don't need to bother you in the future ?

@vmarchaud vmarchaud merged commit 4cda9bd into open-telemetry:main May 25, 2021
@vmarchaud
Copy link
Member

@xukaren Thanks !

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants