Home¶

A pyrig plugin that integrates GitHub CodeQL.

Overview¶

pyrig-codeql is a pyrig plugin that extends pyrig's generated GitHub Actions health-check workflow with a CodeQL analysis job. Install it as a development dependency, then run pyrig sync; plugin discovery applies the override automatically.

uv add pyrig-codeql --dev
uv run pyrig sync

Reusable Code Analysis workflow¶

The plugin adds a reusable .github/workflows/code-analysis.yml workflow and calls it from the generated health-check workflow as the code-analysis job. Its analyze matrix job uses CodeQL to analyze two languages:

Each matrix job checks out the repository, initializes CodeQL, and performs the analysis. The initialization step uses the CodeQL-specific .github/codeql.yml configuration with:

• the security-and-quality query suite, which includes security and code-quality queries;
• paths-ignore for the project's test package (tests/** in this repository), so test-only code is excluded from analysis.

The analysis job uploads results to GitHub code scanning. The pinned action waits for processing by default; findings do not fail that job itself. A separate check-alerts job runs after both matrix entries complete and fails if the analyzed ref has any open CodeQL security or quality alerts, at any severity, whether new or pre-existing. Fixed and dismissed alerts are excluded.

The plugin extends pyrig's jobs_health_check() hook; pyrig automatically adds the reusable code-analysis job to the aggregate health-check job's needs list. The aggregate health check therefore waits for CodeQL and the normal project checks, remaining the workflow's release gate.

API Reference¶

For class- and method-level details, see the API Reference, generated automatically from the source.