search

polkit-org / polkit

polkit (formerly PolicyKit) is a toolkit for defining and handling authorizations. It is used for allowing unprivileged processes to speak to privileged processes.
Other
48 stars 27 forks source link

ci: introduce CodeQL #421

Closed mrc0mmand closed 6 months ago

mrc0mmand commented 6 months ago

Analyze the polkit code using CodeQL [0], to discover potential vulnerabilities before they reach the main branch.

[0] https://codeql.github.com/docs/

Once this is merged, it'll do the initial scan and populate the "Code Scanning" tab in the "Security" repo section, like this:

Screenshot_20240131_204338

(This tab is accessible only to the repo maintainers, given the sensitive nature of some of the alerts.)

Each alert then shows further information and steps how to remediate it:

Screenshot_20240131_204601

I enabled the extended CodeQL queries as well (as I think polkit would benefit from them, given its security nature). However, the extended checks are more prone to false positives, so if that's something you'll find annoying, it can be easily toned back down to only high-precision checks.

The results of the initial scan will be in the Security tab, but any issues introduced in new code will be shown directly in the respective PR that introduced them, so they can be acted on immediately.

github-advanced-security[bot] commented 6 months ago

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.