Codeowners, codeql and stable-pr#25
Conversation
WalkthroughThree new configuration files have been introduced in the repository. A Estimated code review effort🎯 2 (Simple) | ⏱️ ~7 minutes
Note ⚡️ Unit Test Generation is now available in beta!Learn more here, or try it out under "Finishing Touches" below. ✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
nayrukii
changed the title
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (6)
.github/CODEOWNERS (1)
1-1: Terminate the file with a newline characterSome linters and diff viewers complain when the last line of a text file is not newline-terminated.
Add an empty line at the end to keep tooling quiet and stay consistent with POSIX text-file conventions.* @jhelison +.github/workflows/stale-pr.yml (2)
4-5: Strip trailing whitespaceLines 4–5 contain trailing spaces flagged by YAML-lint. While harmless to the runner, they create noisy diffs and can break “fail-on-lint” pipelines.
- - cron: '30 1 * * *'␠␠ + - cron: '30 1 * * *'
14-14: Add a terminating newlineEnds-with-newline keeps YAML-lint quiet and matches repository style.
repo-token: ${{ secrets.GITHUB_TOKEN }} +.github/workflows/codeql.yml (3)
9-15: Fix indentation to silence YAML-lint
security-eventsandpackagesshould be indented two spaces underpermissions:.permissions: - security-events: write - - packages: read + security-events: write + packages: read
16-24: Specify analyzed languages explicitlyWithout
languages:CodeQL defaults can be surprising and may skip analysis if no recognized code is present at checkout time.analyze: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Initialize CodeQL uses: github/codeql-action/init@v3 + with: + languages: python, javascript # <-- adjust to repo languages
24-24: Terminate file with newlineAdd a final newline to satisfy linters.
uses: github/codeql-action/analyze@v3 +
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/CODEOWNERS(1 hunks).github/workflows/codeql.yml(1 hunks).github/workflows/stale-pr.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.7)
.github/workflows/codeql.yml
22-22: the runner of "github/codeql-action/init@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "github/codeql-action/analyze@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
.github/workflows/codeql.yml
[warning] 11-11: wrong indentation: expected 2 but found 4
(indentation)
[error] 24-24: no new line character at the end of file
(new-line-at-end-of-file)
.github/workflows/stale-pr.yml
[error] 4-4: trailing spaces
(trailing-spaces)
[error] 5-5: trailing spaces
(trailing-spaces)
[error] 14-14: no new line character at the end of file
(new-line-at-end-of-file)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: analyze
🔇 Additional comments (1)
.github/workflows/stale-pr.yml (1)
11-14: Clarify stale-bot configurationOnly
days-before-issue-staleis set (-1 disables issues).
If the intent is to mark/close pull requests, you probably want to set the PR-specific keys; otherwise the workflow will keep the default 30-day behaviour.with: days-before-issue-stale: -1 # keep issues untouched + days-before-pr-stale: 14 # mark PRs stale after 14 days + days-before-pr-close: 7 # close 7 days after being markedDouble-check the numbers align with your policy.
| - uses: actions/checkout@v4 | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v2 | ||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v2 No newline at end of file |
There was a problem hiding this comment.
Upgrade CodeQL action to v3 (Node 20) before v2 deprecation
actionlint warns that github/codeql-action@v2 relies on Node 16, which will be removed from GitHub-Hosted runners shortly.
Switching to v3 avoids imminent build failures.
- - name: Initialize CodeQL
- uses: github/codeql-action/init@v2
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v3
@@
- - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v2
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v3📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v2 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v2 | |
| - uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 |
🧰 Tools
🪛 actionlint (1.7.7)
22-22: the runner of "github/codeql-action/init@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-24: the runner of "github/codeql-action/analyze@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.37.1)
[error] 24-24: no new line character at the end of file
(new-line-at-end-of-file)
🤖 Prompt for AI Agents
In .github/workflows/codeql.yml around lines 20 to 24, the CodeQL GitHub Actions
are using version v2, which relies on Node 16 and will soon be deprecated.
Update the uses of github/codeql-action/init and github/codeql-action/analyze
from v2 to v3 to ensure compatibility with Node 20 and prevent build failures.
4 participants
Description
This PR adds configuration updates to improve repository quality and security:
CODEOWNERSfile assigning @jhelison as the maintainer.stale-pr.ymlworkflow to automatically mark and close stale issues and pull requests.codeql.ymlworkflow to enable automated code scanning for security vulnerabilities.These changes are part of the repository hardening efforts to ensure proper review assignment, automated cleanup of old contributions, and vulnerability detection.
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
These are configuration-level changes and do not affect runtime code directly.
CODEOWNERS.stale-pr.ymlandcodeql.ymlworkflows from the working setup inkiijs-sdk.No unit or integration tests are required for this PR.