Skip to content

Home

CI CD ProjectTester

ByteOrderMarkerFormatter CICDLinter CICDSecurityChecker CaseConflictChecker DependencyChecker EndOfFileFormatter EndOfLineFormatter JSONFormatter JSONLinter LargeFileChecker MarkdownLinter MergeConflictChecker ModuleTestNamingChecker PythonLinter SecretsChecker SecurityChecker ShellFormatter ShellLinter SpellChecker TOMLLinter TrailingWhitespaceFormatter TypeChecker YAMLLinter

PackageManager Pyrigger RemoteVersionController VersionControlHookManager VersionController

DocsBuilder PackageIndex ProgrammingLanguage License

A pyrig plugin that integrates GitHub CodeQL.

Overview

pyrig-codeql is a pyrig plugin that extends pyrig's generated GitHub Actions health-check workflow with a CodeQL analysis job. Install it as a development dependency, then run pyrig sync; plugin discovery applies the override automatically.

uv add pyrig-codeql --dev
uv run pyrig sync

Analysis job

The plugin adds an analyze job to the generated health-check workflow. Its matrix runs two independent analyses:

Language Scope
python Python source code
actions GitHub Actions workflow files

Each matrix job checks out the repository, initializes CodeQL, and performs the analysis. The initialization step uses the repository's .github/codeql.yml configuration with:

  • the security-and-quality query suite, the strictest built-in suite;
  • paths-ignore: ["tests/**"], so test-only code is excluded from analysis.

The analysis step uploads the results to GitHub code scanning. Findings reported by CodeQL do not make the action step fail; failures to run the analysis still fail the job.

The analyze job is added to the aggregate health-check job's needs list. As a result, the aggregate health check waits for CodeQL as well as the normal project checks and remains the workflow's release gate.

API Reference

For class- and method-level details, see the API Reference, generated automatically from the source.