[WomB0ComB0]

What

Adds .github/workflows/codeql.yml to this repository, restoring CodeQL
coverage of its Rust sources after it lapsed.

Why

security.yml calls the org reusable security-scan.yml with
languages: '["actions"]'. That analyses the workflow files under .github/
and nothing else, so the on-chain Rust in resq-airspace/, resq-delivery/
and resq-gating/ is not analysed.

Nothing covers it implicitly today either — code-scanning default setup is
not-configured on this repository:

$ gh api repos/resq-software/programs/code-scanning/default-setup
{"state":"not-configured","languages":["actions","rust"], ...}

This repository did have Rust coverage, and lost it

Rust was analysed here, by default setup, until default setup was switched
off. The stored analyses show it: /language:rust rows under the
dynamic/github-code-scanning/codeql:analyze key, ending the day default setup
stopped. See
GET /repos/resq-software/programs/code-scanning/analyses, filtered to
/language:rust. Rust coverage stopped with it, and nothing replaced it.

This PR does not add Rust coverage that never existed; it restores coverage
that lapsed, and puts it in a repo-local workflow that cannot be switched off
by a default-setup toggle elsewhere.

The crates repository has the identical security.yml language input, but
carries a dedicated codeql.yml, and consequently does get Rust coverage.
This PR closes that gap the same way.

Why a separate workflow rather than adding "rust" to security.yml

Adding rust to the existing languages input is a one-line change and was
the first thing considered. It was rejected for a concrete reason:

The reusable revision this repository pins (73b9edb8) carries
continue-on-error: true on its CodeQL Analyze step — it is there to
tolerate a default-setup collision on other repositories. Routing Rust through
that caller would mean a genuine Rust extraction failure passes as green, and
this repository would look scanned without being scanned. Since the whole
point of this PR is to stop exactly that situation, Rust gets its own caller
with failures left visible.

The dedicated workflow also pins the codeql-action version already proven
against Rust in crates, rather than the older one the pinned reusable still
uses.

---

vendor/ is nominally analysed, not meaningfully analysed

Worth stating plainly, because this PR's own run log says so. The Rust
extraction splits cleanly along the first-party / vendor/ line: the
first-party files under resq-airspace/, resq-delivery/ and resq-gating/
extract without error, and the files under vendor/ extract with errors. Three
vendored manifests fail to resolve at all:

ERROR failed to load workspace for .../vendor/solana-invoke/Cargo.toml
ERROR failed to load workspace for .../vendor/solana-keypair/Cargo.toml
ERROR failed to load workspace for .../vendor/solana-program-test/Cargo.toml

and every file beneath vendor/ then draws:

WARN .../vendor/<crate>/src/lib.rs:1:1: semantic analyzer unavailable
     (unable to load manifest): macro expansion will be skipped.

So vendor/ lands in the database as syntax with no semantic analyzer and
no macro expansion. The suite that runs here is dominated by path-problem
dataflow/taint queries, which need resolved types and expanded macros to follow
a value from source to sink. On heavily macro-driven Solana crates, skipping
macro expansion removes most of the code those queries would have to traverse.

The honest statement is therefore: this PR gives the first-party Rust real
CodeQL coverage, and gives vendor/ a listing in the database that should not
be mistaken for analysis. That is still a strict improvement over the status
quo of no Rust coverage, and it is the reason to merge.

Follow-up, deliberately not in this PR, because either direction is a
judgement call the reviewer should make:

• add paths-ignore: vendor/** via an init config, so the extraction summary
  stops implying coverage that is not there; or
• make the three vendored manifests resolve, so vendor/ is genuinely
  analysed — which is the option that matches the original intent, since these
  are locally patched crates.

Disclosure: Rust CodeQL has found almost nothing in this org

Material to a PR whose value proposition is Rust coverage. crates has been
running /language:rust for months, and it has raised a single alert ever:
crates#39,
rust/unused-variable at crates/resq-health/src/main.rs, severity note,
since fixed. Nothing at a security severity. It is a quality rule, from the
security-and-quality suite this workflow also requests.

A reviewer should weigh that honestly. The counter-argument is that it is an
argument about base rate, not about this repository: crates is off-chain
tooling, whereas the code this PR covers is on-chain program logic handling
custody and authorization, where the CWE-825/CWE-770/CWE-078 queries in the
suite are far more apposite. It is also the standard argument for any
static-analysis gate — the value is in the run that eventually catches
something.

I do not think it is a reason to withdraw the PR. It is a reason not to
describe this as closing a meaningful security gap without qualification.

Verification

• rust is the correct CodeQL language identifier, and has no alias form —
  confirmed against src/languages/builtin.json in github/codeql-action.
• The workflow executes successfully on this branch — CodeQL (Rust) is
  success, and the analysis it produced is stored under this workflow's own
  analysis_key (.github/workflows/codeql.yml:codeql, refs/pull/86/merge),
  not default setup's.
• Both action pins re-checked against git ls-remote --tags:
  • actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 → refs/tags/v7.0.1 ✓
  • github/codeql-action@1c5b675653bb5c22dbe9b12b556ec555138e09fd → refs/tags/v4.38.1 ✓
• actionlint — clean (exit 0), control-confirmed against a deliberately
  broken workflow which correctly raised expression and syntax-check
  errors.
• persist-credentials: false on the checkout; nothing in the job pushes.

Notes for the reviewer

• Do not enable default setup on this repository without removing this
  workflow first. If it is turned on, it will start rejecting this workflow's
  uploads with CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled, and — because the org reusable
  swallows that rejection with continue-on-error — Rust coverage would
  disappear behind a green check.

  Default setup can cover Rust here: it lists ["actions","rust"] as
  available and it did analyse Rust on this repository until it was switched
  off. The two are simply mutually exclusive — enabling one disables the
  other's uploads. Either is a defensible configuration; running both is not.

• The first run takes a few minutes: the Rust extractor resolves cargo
  manifests (LoadManifest) rather than running a full cargo build. That
  design is also why the three unresolvable vendor/ manifests degrade to
  syntax-only rather than failing the job.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 600afd56-9f13-49d4-b57d-41bb67e5ba58

📥 Commits

Reviewing files that changed from the base of the PR and between beee618 and 4b212d2.

📒 Files selected for processing (1)

• .github/workflows/codeql.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow for Rust CodeQL analysis. It runs on configured pushes, pull requests, a weekly schedule, and manual dispatch. It checks out the repository, builds and analyzes Rust code, and uploads results.

Changes

Rust CodeQL analysis

Layer / File(s)	Summary
Configure and run Rust CodeQL analysis .github/workflows/codeql.yml	Defines workflow triggers and permissions. Skips pull request runs for documentation-only changes, cancels in-progress pull request runs, and runs Rust CodeQL analysis with security-and-quality queries.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 4b212

The workflow adds Rust security analysis alongside existing Actions scanning. No merge-blocking issue is established; normal workflow validation remains appropriate.

Architecture Summary

Architecture risk: 🔵 Low · up to 4b212

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/codeql.yml: Adds a workflow that runs Rust CodeQL analysis on the configured push, pull-request, scheduled, and manual triggers. Pull requests ignore documentation-only changes matching docs/** or *.md; only pull-request runs are cancelable in progress. The job checks out without persisted credentials, initializes Rust analysis with security-and-quality queries, runs autobuild and analysis, and uploads results with the /language:rust category. It grants contents: read, security-events: write, and actions: read.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding Rust CodeQL coverage through CI.

✨ Finishing Touches 💡 1

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Audit Results: PASS

The changes in this pull request have been audited for security vulnerabilities, logic bugs, and performance issues. The new CodeQL workflow for Rust is well-configured and follows established best practices:

• Security: Actions are pinned to specific SHAs with version comments, and the job uses minimal required permissions (contents: read, security-events: write, actions: read). persist-credentials: false is correctly set for the checkout step.
• Logic: The workflow is correctly triggered on relevant branches and paths. The use of a separate workflow for Rust (with continue-on-error: false) is a sound decision to ensure extraction failures are visible, as explained in the file comments.
• Consistency: The versions used (e.g., actions/checkout@v7.0.1) are consistent with other recent workflows in the repository like label-sync.yml.
• Performance: Concurrency groups and documentation-only path exclusions are correctly implemented to optimize runner usage.

No issues were identified.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

Generated by ai-auditor for issue #86 · ◷