What the developer wrote
Authored by Ilya Artemov
reusable_codeql_checks
What changed, and why it matters
This commit only changes the project's GitHub Actions workflow file. It replaces an inline CodeQL security-scanning job with a call to a shared, reusable workflow maintained by Ledger. No application source code, cryptographic logic, or user-facing behavior is modified. There is no direct security vulnerability in this change.
No action required. Optionally verify that the reusable workflow LedgerHQ/ledger-app-workflows/.github/workflows/reusable_codeql_checks.yml@v1 preserves equivalent CodeQL query suites (security-and-quality) and build matrix coverage.
Security signals we found
CI/CD workflow refactoring only
No source-code changes
CodeQL security scanning still triggered via reusable workflow
Evidence from the diff
The diff removes the explicit CodeQL initialization, build, and analysis steps from .github/workflows/codeql-workflow.yml and delegates them to LedgerHQ/ledger-app-workflows/.github/workflows/reusable_codeql_checks.yml@v1 using workflow reuse (uses: … with secrets: inherit). The triggers remain the same (push to master/develop, all pull requests). This is a CI/CD refactoring.
Changed components
.github/workflows/codeql-workflow.ymlInspect captured patch +3 / −32
diff --git a/.github/workflows/codeql-workflow.yml b/.github/workflows/codeql-workflow.yml
index ee94d60..2fd9d99 100644
--- a/.github/workflows/codeql-workflow.yml
+++ b/.github/workflows/codeql-workflow.yml
@@ -7,39 +7,10 @@ on:
- master
- develop
pull_request:
- branches:
- - master
- - develop
jobs:
analyse:
- name: CodeQL Analyse of boilerplate application
- strategy:
- matrix:
- include:
- - SDK: "$NANOX_SDK"
- artifact: boilerplate-app-nanoX
- - SDK: "$NANOSP_SDK"
- artifact: boilerplate-app-nanoSP
- language: [ 'cpp' ]
- runs-on: ubuntu-latest
- container:
- image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder-lite:latest
-
- steps:
- - name: Clone
- uses: actions/checkout@v4
-
- - name: Initialize CodeQL
- uses: github/codeql-action/init@v2
- with:
- languages: ${{ matrix.language }}
- queries: security-and-quality
-
- - name: Build
- run: |
- make BOLOS_SDK=${{ matrix.SDK }}
-
- - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v2
+ name: Call Ledger CodeQL analysis
+ uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_codeql_checks.yml@v1
+ secrets: inherit
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.