From 6916a008ec612b4575d8f630c6745e776207e30a Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Thu, 18 Jun 2026 11:41:03 -0400 Subject: [PATCH 1/8] PYTHON-5877 Add codeql composite action Centralises the CodeQL analysis steps and pinned action version so Dependabot only needs to update one file for all drivers. --- README.md | 48 +++++++++++++++++++++++++++++++++++++++++++++++ codeql/action.yml | 48 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+) create mode 100644 codeql/action.yml diff --git a/README.md b/README.md index e6a2b28..cf01b0f 100644 --- a/README.md +++ b/README.md @@ -252,6 +252,54 @@ There are several ways to specify the security report: - By specifying a relative path, which is then linked to the corresponding git blob for the tagged version - By adding the `security-report-url` to the AWS Secrets Vault +## Security Actions + +### CodeQL Analysis + +This action runs CodeQL analysis for a single language. It includes checkout, +Python setup, CodeQL initialization, an optional manual build step, and the +analysis itself — centralising the pinned CodeQL action version so Dependabot +only needs to update one file across all drivers. + +```yaml +jobs: + analyze: + runs-on: ubuntu-latest + timeout-minutes: 360 + permissions: + security-events: write + strategy: + fail-fast: false + matrix: + include: + - language: c-cpp + build-mode: manual + - language: python + build-mode: none + - language: actions + build-mode: none + steps: + - uses: mongodb-labs/drivers-github-tools/codeql@v3 + with: + language: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + config: | + paths-ignore: + - 'doc/**' + - 'test/**' +``` + +Pass `ref` when the workflow is invoked via `workflow_call` with a specific git +ref: + +```yaml + - uses: mongodb-labs/drivers-github-tools/codeql@v3 + with: + language: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + ref: ${{ inputs.ref }} +``` + ## Other Common Actions ### Full Report diff --git a/codeql/action.yml b/codeql/action.yml new file mode 100644 index 0000000..5890c15 --- /dev/null +++ b/codeql/action.yml @@ -0,0 +1,48 @@ +name: CodeQL Analysis +description: Run CodeQL analysis for a single language. + +inputs: + language: + description: Language to analyze (e.g. c-cpp, python, actions, javascript). + required: true + build-mode: + description: Build mode for CodeQL (none, manual, autobuild). + default: none + ref: + description: Git ref to check out. Leave empty to use the default checkout behavior. + default: '' + queries: + description: CodeQL query suite to run. + default: security-extended + config: + description: Inline CodeQL YAML configuration (e.g. a paths-ignore block). + default: '' + +runs: + using: composite + steps: + - name: Checkout repository + uses: actions/checkout@v6.0.3 + with: + ref: ${{ inputs.ref }} + persist-credentials: false + + - uses: actions/setup-python@v6 + + - name: Initialize CodeQL + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + with: + languages: ${{ inputs.language }} + build-mode: ${{ inputs.build-mode }} + queries: ${{ inputs.queries }} + config: ${{ inputs.config }} + + - if: ${{ inputs.build-mode == 'manual' }} + name: Build + shell: bash + run: pip install -e . + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + with: + category: "/language:${{ inputs.language }}" From 96be04dea70ba0bbfe59c6268727b2a7803c2dac Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Tue, 23 Jun 2026 09:18:18 -0400 Subject: [PATCH 2/8] Update README.md Co-authored-by: Steven Silvester --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index cf01b0f..9bc1972 100644 --- a/README.md +++ b/README.md @@ -257,9 +257,9 @@ There are several ways to specify the security report: ### CodeQL Analysis This action runs CodeQL analysis for a single language. It includes checkout, -Python setup, CodeQL initialization, an optional manual build step, and the +language setup, CodeQL initialization, an optional manual build step, and the analysis itself — centralising the pinned CodeQL action version so Dependabot -only needs to update one file across all drivers. +only needs to update one file across all repos using the action. ```yaml jobs: From a2d7186469ffae8a13e3c0bae1f0f67a60ae6230 Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Wed, 1 Jul 2026 16:18:59 -0400 Subject: [PATCH 3/8] Copilot review --- README.md | 3 +++ codeql/action.yml | 9 ++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 9bc1972..4a384b3 100644 --- a/README.md +++ b/README.md @@ -274,6 +274,7 @@ jobs: include: - language: c-cpp build-mode: manual + manual-build-command: make - language: python build-mode: none - language: actions @@ -283,6 +284,7 @@ jobs: with: language: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} + manual-build-command: ${{ matrix.manual-build-command }} config: | paths-ignore: - 'doc/**' @@ -297,6 +299,7 @@ ref: with: language: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} + manual-build-command: ${{ matrix.manual-build-command }} ref: ${{ inputs.ref }} ``` diff --git a/codeql/action.yml b/codeql/action.yml index 5890c15..1f84aa8 100644 --- a/codeql/action.yml +++ b/codeql/action.yml @@ -8,6 +8,9 @@ inputs: build-mode: description: Build mode for CodeQL (none, manual, autobuild). default: none + manual-build-command: + description: Shell command to run when build-mode is manual. + default: '' ref: description: Git ref to check out. Leave empty to use the default checkout behavior. default: '' @@ -22,12 +25,12 @@ runs: using: composite steps: - name: Checkout repository - uses: actions/checkout@v6.0.3 + uses: actions/checkout@v4 with: ref: ${{ inputs.ref }} persist-credentials: false - - uses: actions/setup-python@v6 + - uses: actions/setup-python@v5 - name: Initialize CodeQL uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 @@ -40,7 +43,7 @@ runs: - if: ${{ inputs.build-mode == 'manual' }} name: Build shell: bash - run: pip install -e . + run: ${{ inputs.manual-build-command }} - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 From 570d50212da33a82def0720da8880ae7bd1f4589 Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Tue, 7 Jul 2026 10:47:27 -0400 Subject: [PATCH 4/8] Address review: fix shell injection, add Node24 env, validate manual build --- codeql/action.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/codeql/action.yml b/codeql/action.yml index 1f84aa8..fe7cd90 100644 --- a/codeql/action.yml +++ b/codeql/action.yml @@ -31,9 +31,13 @@ runs: persist-credentials: false - uses: actions/setup-python@v5 + env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" - name: Initialize CodeQL uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" with: languages: ${{ inputs.language }} build-mode: ${{ inputs.build-mode }} @@ -43,9 +47,18 @@ runs: - if: ${{ inputs.build-mode == 'manual' }} name: Build shell: bash - run: ${{ inputs.manual-build-command }} + env: + MANUAL_BUILD_COMMAND: ${{ inputs.manual-build-command }} + run: | + if [ -z "$MANUAL_BUILD_COMMAND" ]; then + echo "::error::build-mode is 'manual' but no manual-build-command was provided." >&2 + exit 1 + fi + bash -c "$MANUAL_BUILD_COMMAND" - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" with: category: "/language:${{ inputs.language }}" From a52fbd4cda169453576026993c546d0327309ed6 Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Wed, 8 Jul 2026 12:37:30 -0400 Subject: [PATCH 5/8] Address review: cpp language id, conditional Python setup, Node24 on checkout, pin version comments, README YAML --- README.md | 51 ++++++++++++++++++++++++----------------------- codeql/action.yml | 11 ++++++---- 2 files changed, 33 insertions(+), 29 deletions(-) diff --git a/README.md b/README.md index 4a384b3..b9b84ec 100644 --- a/README.md +++ b/README.md @@ -257,9 +257,10 @@ There are several ways to specify the security report: ### CodeQL Analysis This action runs CodeQL analysis for a single language. It includes checkout, -language setup, CodeQL initialization, an optional manual build step, and the -analysis itself — centralising the pinned CodeQL action version so Dependabot -only needs to update one file across all repos using the action. +Python setup (only when `language: python`), CodeQL initialization, an optional +manual build step, and the analysis itself — centralising the pinned CodeQL +action version so Dependabot only needs to update one file across all repos +using the action. ```yaml jobs: @@ -272,35 +273,35 @@ jobs: fail-fast: false matrix: include: - - language: c-cpp - build-mode: manual - manual-build-command: make - - language: python - build-mode: none - - language: actions - build-mode: none + - language: cpp + build-mode: manual + manual-build-command: make + - language: python + build-mode: none + - language: actions + build-mode: none steps: - - uses: mongodb-labs/drivers-github-tools/codeql@v3 - with: - language: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - manual-build-command: ${{ matrix.manual-build-command }} - config: | - paths-ignore: - - 'doc/**' - - 'test/**' + - uses: mongodb-labs/drivers-github-tools/codeql@v3 + with: + language: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + manual-build-command: ${{ matrix.manual-build-command }} + config: | + paths-ignore: + - 'doc/**' + - 'test/**' ``` Pass `ref` when the workflow is invoked via `workflow_call` with a specific git ref: ```yaml - - uses: mongodb-labs/drivers-github-tools/codeql@v3 - with: - language: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - manual-build-command: ${{ matrix.manual-build-command }} - ref: ${{ inputs.ref }} + - uses: mongodb-labs/drivers-github-tools/codeql@v3 + with: + language: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + manual-build-command: ${{ matrix.manual-build-command }} + ref: ${{ inputs.ref }} ``` ## Other Common Actions diff --git a/codeql/action.yml b/codeql/action.yml index fe7cd90..251323d 100644 --- a/codeql/action.yml +++ b/codeql/action.yml @@ -3,7 +3,7 @@ description: Run CodeQL analysis for a single language. inputs: language: - description: Language to analyze (e.g. c-cpp, python, actions, javascript). + description: Language to analyze (e.g. cpp, python, actions, javascript). required: true build-mode: description: Build mode for CodeQL (none, manual, autobuild). @@ -26,16 +26,19 @@ runs: steps: - name: Checkout repository uses: actions/checkout@v4 + env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" with: ref: ${{ inputs.ref }} persist-credentials: false - - uses: actions/setup-python@v5 + - if: ${{ inputs.language == 'python' }} + uses: actions/setup-python@v5 env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" with: @@ -57,7 +60,7 @@ runs: bash -c "$MANUAL_BUILD_COMMAND" - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" with: From bcf33e5af274a565cbe0a4288417260cd80d49ec Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Wed, 8 Jul 2026 12:48:59 -0400 Subject: [PATCH 6/8] Add autobuild step for build-mode: autobuild --- codeql/action.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/codeql/action.yml b/codeql/action.yml index 251323d..8c2396c 100644 --- a/codeql/action.yml +++ b/codeql/action.yml @@ -59,6 +59,12 @@ runs: fi bash -c "$MANUAL_BUILD_COMMAND" + - if: ${{ inputs.build-mode == 'autobuild' }} + name: Autobuild + uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" + - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 env: From 0f0e0c83a18175b26550d39f04fa82d25f6c9228 Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Wed, 8 Jul 2026 12:56:08 -0400 Subject: [PATCH 7/8] Make checkout ref fall back to github.ref when input is empty --- codeql/action.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/codeql/action.yml b/codeql/action.yml index 8c2396c..322a604 100644 --- a/codeql/action.yml +++ b/codeql/action.yml @@ -12,7 +12,7 @@ inputs: description: Shell command to run when build-mode is manual. default: '' ref: - description: Git ref to check out. Leave empty to use the default checkout behavior. + description: Git ref to check out. Leave empty to fall back to github.ref (the triggering ref). default: '' queries: description: CodeQL query suite to run. @@ -29,7 +29,7 @@ runs: env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" with: - ref: ${{ inputs.ref }} + ref: ${{ inputs.ref || github.ref }} persist-credentials: false - if: ${{ inputs.language == 'python' }} From 6e135ce0d2d9bccaad65f40ba724bd25a09d8836 Mon Sep 17 00:00:00 2001 From: Jeffrey 'Alex' Clark Date: Wed, 8 Jul 2026 13:03:00 -0400 Subject: [PATCH 8/8] README: add contents/actions read permissions to CodeQL example --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index b9b84ec..d23f9c1 100644 --- a/README.md +++ b/README.md @@ -269,6 +269,8 @@ jobs: timeout-minutes: 360 permissions: security-events: write + contents: read + actions: read strategy: fail-fast: false matrix: