[ci] swift CodeQL workflow config by ddol · Pull Request #484 · banshee-data/velocity.report

ddol · 2026-04-28T19:54:56Z

Purpose

This pull request adds a new GitHub Actions workflow for automated security scanning using CodeQL. The workflow is configured to run on pushes to the main branch, on pull requests, and on a weekly schedule. It analyzes multiple languages present in the repository and uploads security findings to GitHub.

Changes

Security and CI improvements:

Added a new .github/workflows/codeql.yml workflow to automatically run CodeQL security scans for Actions, Go, JavaScript/TypeScript, and Python code on pushes, pull requests, and a weekly schedule. This helps identify potential security vulnerabilities early in the development process.

Checklist

Uses British English spelling/wording where applicable.
Design is confirmed and aligns with DESIGN.md.
Any maths/derived values are valid and up to date.
Version has been bumped where required.
Documentation is up to date.
README.md is up to date.
docs/DEVLOG.md is up to date.

Copilot

Pull request overview

Adds a dedicated GitHub Actions workflow to run GitHub CodeQL code scanning across the repository’s main languages, enabling automated security analysis on PRs, main-branch pushes, and a weekly schedule.

Changes:

Added a new CodeQL workflow triggered on push to main, pull_request, and a weekly cron.
Configured a language matrix for Actions, Go, JavaScript/TypeScript, and Python.
Uploads CodeQL results to GitHub code scanning.

ddol · 2026-04-29T03:17:51Z

Status update — commit `07da22f`

All four review comments addressed. Latest commit (07da22f) also upgrades codeql-action v3 → v4 and adds Swift.

Changes in 07da22f:

Swift matrix entry added (macos-latest runner, autobuild)
All three codeql-action actions (init / autobuild / analyze) pinned to v4 SHA 95e58e9a — resolves the Node.js 20 deprecation warning (v4 uses Node 24)
packages: read + actions: read permissions added per the v4 template
Schedule cron aligned to the upstream template (Saturday 04:17 UTC)

One remaining blocker (cannot fix in code):

The Analyze jobs are failing with:

CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled

The repo currently has GitHub's default CodeQL setup enabled. Advanced and default setups cannot coexist. To fix this:

Settings → Security → Code scanning → CodeQL → Disable default setup

Once that's off the advanced workflow will be able to upload SARIF results and the jobs will pass.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: David Dolphin <445312+ddol@users.noreply.github.com>

@V3

The pin-ci tool replaced @V3 tags with fabricated SHAs that GitHub could not resolve. Pinned all three codeql-action steps to the real commit SHA for v3.35.2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Add swift matrix entry (macos-latest runner) as requested by the new advanced setup template - Upgrade all codeql-action pins from v3.35.2 → v4 (95e58e9a2cdfd71adc6e0353d5c52f41a045d225) to resolve Node.js 20 deprecation warnings (v4 uses Node 24) - Align schedule cron to the upstream template (Saturday 04:17 UTC) - Add packages: read and actions: read permissions per v4 template Note: the 'default setup vs advanced setup' conflict (current CI failure) requires disabling GitHub's default CodeQL setup in repo Settings → Security → Code scanning → CodeQL before this workflow can upload results. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…d add build step

Co-authored-by: Copilot <copilot@github.com>

… releases and setup guide Co-authored-by: Copilot <copilot@github.com>

@Pinned

…lchain (#486) * [ai][ci] DRY proto pipeline: shared scripts, composite action, pinned toolchain Introduces a toolchain-pinned, script-backed proto generation pipeline so macOS build, tests, and CodeQL all invoke the same generation logic: scripts/install-proto-tooling.sh - Installs pinned protoc + Go plugins (go install @Pinned version) + swift- protobuf (brew) + protoc-gen-grpc-swift-2 (built from grpc-swift-protobuf tag 2.0.0) on macOS; Go plugins + protoc on Linux. - --check mode verifies all tools are present without installing. scripts/generate-protos.sh go|swift|all - Single canonical protoc invocation for each language, repo-root-relative. - Fails fast with clear error + install hint if a tool is missing. Makefile - proto-gen-go / proto-gen-swift now delegate to generate-protos.sh. - build-mac / test-mac call proto-gen-swift before xcodebuild so fresh checkouts always have generated stubs. .github/actions/setup-proto/action.yml - Composite action: caches protoc-gen-grpc-swift-2, runs install script, optionally generates (generate: swift|go|all|none). .github/workflows/codeql.yml - Swift job uses setup-proto before xcodebuild — fixes Velocity_Visualiser_V1_* symbol resolution failures on clean runners. .github/workflows/mac-ci.yml - setup job uses composite action instead of inline brew/clone steps. - Trigger paths include install/generate scripts and composite action. Docs (CLAUDE.md, COMMANDS.md, DEBUGGING.md) - Bootstrap command documented alongside make proto-gen. - Troubleshooting entry for missing Velocity_Visualiser_V1_* symbols. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * [ai][ci] install-proto-tooling: remove dead var, accurate wording, prereq checks, --force - Remove unused GRPC_SWIFT_BIN variable (install always targets /usr/local/bin directly) - Clarify header: Go plugins are pinned by module version; protoc and swift-protobuf are Homebrew latest (no formula-version pinning available) - Add explicit `need git` / `need swift` checks with actionable error messages before git clone / swift build - Add --force flag to force reinstall of protoc-gen-grpc-swift-2 even when a binary is already on PATH; default behaviour is unchanged Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * [ai][ci] setup-proto: derive cache key from hashFiles(install script) Replaces hardcoded '2.0.0' in the grpc-swift cache key with hashFiles('scripts/install-proto-tooling.sh') so the cache busts automatically whenever the install script changes (including version bumps), with no manual key update required. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * [ai][docs] DEBUGGING.md: clarify which proto outputs are gitignored Swift stubs (tools/visualiser-macos/.../Generated/) are gitignored; Go stubs (internal/lidar/l9endpoints/pb/) are committed. The previous wording "Generated files are gitignored" implied both, which was wrong. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * [ci] add go * [ai][ci] pin setup-go to v5.5.0 SHA, add Go setup to mac-ci and codeql SHA-pin actions/setup-go@v5 → @d35c59ab... # v5.5.0 in codeql.yml to fix the action-pin CI check (same SHA used by go-ci.yml and nightly-full-ci.yml). Add 'Setup Go' step (go-version-file: go.mod) to mac-ci.yml setup job before the setup-proto composite action: the install script calls `go install` for the protoc-gen-go plugins and was failing with 'go not found' on the macOS runner which has no Go by default. All Go CI now uses go-version-file: go.mod — no hardcoded version strings. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * [ai][ci] install-proto-tooling: force native ARM for brew on Apple Silicon On GitHub-hosted ARM macOS runners the CodeQL action launches job steps under Rosetta (x86_64 emulation). Homebrew's native ARM prefix (/opt/homebrew) then refuses to install with: "Cannot install under Rosetta 2 in ARM default prefix" Detect arm64 at runtime and prefix the brew invocation with `arch -arm64` so the formula install runs natively regardless of the parent shell's architecture mode. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…kage.resolved The Xcode project's Package.resolved pins grpc-swift-protobuf at 2.1.2 (runtime). The codegen plugin was still built from the 2.0.0 tag, which emits MethodDescriptor(name:type:) — a signature the 2.1.2 runtime no longer accepts. Bump GRPC_SWIFT_PROTOBUF_VERSION in the install script (used by the setup-proto composite action for mac-ci and CodeQL) and the inline clone in nightly-full-ci to 2.1.2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

codecov · 2026-04-30T23:01:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

ddol self-assigned this Apr 28, 2026

Copilot AI review requested due to automatic review settings April 28, 2026 19:54

Copilot started reviewing on behalf of ddol April 28, 2026 19:55

View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

Comment thread .github/workflows/codeql.yml

Comment thread .github/workflows/codeql.yml Outdated

Comment thread .github/workflows/codeql.yml Outdated

Comment thread .github/workflows/codeql.yml Outdated

ddol and others added 4 commits April 29, 2026 19:11

[ci] Add CodeQL workflow for automated security analysis

f93942f

Apply suggestions from code review

8825cd0

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: David Dolphin <445312+ddol@users.noreply.github.com>

[ci] Fix codeql-action SHA pins to valid v3.35.2 commit

d589445

The pin-ci tool replaced @V3 tags with fabricated SHAs that GitHub could not resolve. Pinned all three codeql-action steps to the real commit SHA for v3.35.2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ddol force-pushed the dd/ci/add-swift branch from 07da22f to 5451953 Compare April 30, 2026 02:11

[ci] Update CodeQL workflow for Swift: change build mode to manual an…

5483bf8

…d add build step

ddol mentioned this pull request Apr 30, 2026

[ci] DRY proto pipeline: shared scripts, composite action, pinned toolchain #486

Merged

4 tasks

ddol and others added 4 commits April 30, 2026 00:23

[mac] Update AboutView content for clarity and detail

e80f302

Co-authored-by: Copilot <copilot@github.com>

[mac] Enhance AboutView content: update descriptions and add links to…

c14b8cc

… releases and setup guide Co-authored-by: Copilot <copilot@github.com>

fix(ci)[ai][bash]: run Homebrew natively on ARM in proto setup

c3a33b3

ddol closed this Jun 10, 2026

ddol mentioned this pull request Aug 14, 2026

[docs] standardise key docs, devlog catch-up for 0.5.1 #552

Merged

7 tasks done

Navigation Menu

Repository navigation

[ci] swift CodeQL workflow config - #484

[ci] swift CodeQL workflow config#484
ddol wants to merge 10 commits into
mainfrom
dd/ci/add-swift

ddol commented Apr 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ddol commented Apr 29, 2026

Uh oh!

codecov Bot commented Apr 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ddol commented Apr 28, 2026

Purpose

Changes

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ddol commented Apr 29, 2026

Status update — commit 07da22f

Uh oh!

codecov Bot commented Apr 30, 2026

Codecov Report

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Status update — commit `07da22f`