You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Migrate this repo's CodeQL scan from repo-local workflow steps to the centrally maintained reusable workflow in NVIDIA/security-workflows.
The motivation is maintenance, not coverage: today every repo carries its own copy of the CodeQL action pins and query-suite configuration, so a CodeQL action bump or a suite change has to be replayed repo by repo.
Calling the shared workflow moves that to one place.
Changes
.github/workflows/codeql.yml now calls NVIDIA/security-workflows/.github/workflows/sast-scan-codeql.yml, pinned to a reviewed 40-character commit SHA.
Removes the repo-local checkout / codeql-action/init / codeql-action/analyze steps and their pins — the reusable workflow owns them.
Moves permissions to the workflow level, since a caller must grant every permission the reusable workflow declares.
Behavior
Unchanged. Same triggers, concurrency group, action, language, build-mode, security-extended suite, and runners i.e.ubuntu-latest. runs-on and queries are passed explicitly rather than relying on the shared workflow's defaults, so this repo's coverage can't drift with upstream.
Notes for reviewers
Check name changes from Analyze (python) to Analyze / CodeQL (python) — reusable-workflow jobs are namespaced by the calling job. Any branch-protection rule requiring the old name needs updating, otherwise it will read as a missing
Checklist
New or existing tests cover these changes.
The documentation is up to date with these changes.
The ask: does it make sense for cuda-python to get its CodeQL scan from a central reusable workflow instead of carrying its own copy?
Why I'm proposing it: this is a maintenance change, not a coverage change.
Today every NVIDIA repo running CodeQL carries its own codeql-action pins and query-suite config, so a CodeQL action bump or a suite change has to be replayed repo by repo. Calling NVIDIA/security-workflows moves that to one place. It's part of the GitHub-First security-scanning enablement work — same pattern already used for the Pulse secret scan.
The one thing that changes: the check name goes from Analyze (python) to Analyze / CodeQL (python), because reusable-workflow jobs are namespaced by the calling job.
Happy to hold this or to adjust the approach.
Note: I only have read access here, so I can't add reviewers through the sidebar — hence the mention.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Migrate this repo's CodeQL scan from repo-local workflow steps to the centrally maintained reusable workflow in NVIDIA/security-workflows.
The motivation is maintenance, not coverage: today every repo carries its own copy of the CodeQL action pins and query-suite configuration, so a CodeQL action bump or a suite change has to be replayed repo by repo.
Calling the shared workflow moves that to one place.
Changes
.github/workflows/codeql.ymlnow callsNVIDIA/security-workflows/.github/workflows/sast-scan-codeql.yml, pinned to a reviewed 40-character commit SHA.checkout/codeql-action/init/codeql-action/analyzesteps and their pins — the reusable workflow owns them.permissionsto the workflow level, since a caller must grant every permission the reusable workflow declares.Behavior
Unchanged. Same triggers, concurrency group, action, language, build-mode, security-extended suite, and runners i.e.
ubuntu-latest.runs-onandqueriesare passed explicitly rather than relying on the shared workflow's defaults, so this repo's coverage can't drift with upstream.Notes for reviewers
Analyze (python)toAnalyze / CodeQL (python)— reusable-workflow jobs are namespaced by the calling job. Any branch-protection rule requiring the old name needs updating, otherwise it will read as a missingChecklist