Finding security vulnerabilities with CodeQL

This is a short recipe that we will use to add a CodeQL analysis to our existing CI build. CodeQL is the code analysis engine from GitHub, and it is free for public repositories.

Getting ready

Create a new branch in the package-recipe repository:

$ git switch -c add-codeql

How to do it…

1. Open the .github/workflows/ci.yml file and grant the build job permissions to write security events:

   build:
     permissions:
       pull-requests: write
       security-events: write

2. Add an init action (github/codeql-action/init) to the job. For languages that must be compiled, this has to go before the build process. As JavaScript is a static language, you can add it to the end of the job. Set the language to javascript-typescript and select the security-and-quality query suite:

         - name: Initialize CodeQL
           ...