Skip to content

fix: Fail closed when C# security scanning fails#1792

Merged
hatayama merged 5 commits into
security/cli-distribution-hardening-integrationfrom
fix/codeql-security-scan
Jul 15, 2026
Merged

fix: Fail closed when C# security scanning fails#1792
hatayama merged 5 commits into
security/cli-distribution-hardening-integrationfrom
fix/codeql-security-scan

Conversation

@hatayama

@hatayama hatayama commented Jul 15, 2026

Copy link
Copy Markdown
Owner

Summary

  • Replace the placeholder-producing C# scanner with SHA-pinned CodeQL 2.26.0 using C# build-mode: none and security-extended.
  • Validate completion, SARIF identity, extraction coverage, and database quality before uploading results.
  • Record the scanner decision, rejected alternatives, and the deferred Unity-reference accuracy and repository-wide corpus improvements.

Security behavior

  • Scanner failure, missing or malformed SARIF, unexpected schema/tool/version, unsuccessful invocation, missing no-build completion, empty extraction, and database collapse fail closed.
  • Call-target resolution below 55% or known-type resolution below 70% fails the job.
  • Resolution below the 2026-07-15 PoC baseline of 68% / 82%, but above the hard floors, emits a nonblocking GitHub Actions warning.
  • Fork pull requests run the same guard and skip only the SARIF upload because their token cannot receive security-events: write.
  • Repository CodeQL default setup is not-configured, so the advanced workflow upload does not conflict with default setup.

Probe evidence

An out-of-repository temporary .NET Framework probe passed HttpContext query input to Process.Start. CodeQL CLI 2.26.0 with codeql/csharp-queries@1.7.5 and security-extended produced one cs/command-line-injection result in SARIF 2.1.0. The vulnerable source and analysis database were removed; a minimal result fixture remains solely as regression evidence.

Scanner decision

The full decision and future accuracy work are recorded in docs/security-scan-engine-decision.md.

Verification

  • scripts/test-security-scan-workflow.sh
  • go test ./cmd/check-codeql-sarif ./internal/automation
  • actionlint v1.7.12 .github/workflows/security-scan.yml
  • scripts/check-go-cli.sh
  • Release trigger guard
  • Exact-head Security Code Scan: https://github.com/hatayama/unity-cli-loop/actions/runs/29406641334
    • Head: 54f4f8f98aec26d1300a0cb661b41e9988ddfc7d
    • C# Security Analysis: success, including CodeQL 2.26.0, SARIF guard, and verified upload
    • Go CLI Security Analysis: success, including all-module checks and govulncheck

hatayama added 3 commits July 15, 2026 18:15
Validate the pinned CodeQL report before upload so missing, malformed,
or degraded C# analysis cannot be reported as a successful zero-finding scan.
Replace the placeholder SecurityCodeScan workflow with a pinned no-build
CodeQL analysis and validate its SARIF before uploading any results.
Make schema and bundled CodeQL version changes explicit failures before a
security scan result can be uploaded.
@coderabbitai

coderabbitai Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Warning

Review limit reached

@hatayama, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 13 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8c7a63cc-1710-4343-a9f3-bcb73bfe2a14

📥 Commits

Reviewing files that changed from the base of the PR and between a74133c and 54f4f8f.

📒 Files selected for processing (2)
  • cli/release-automation/internal/automation/codeql_sarif_guard_test.go
  • docs/security-scan-engine-decision.md
📝 Walkthrough

Walkthrough

The security scan workflow now uses CodeQL for C# analysis, validates generated SARIF reports with a new Go guard, and uploads verified results. Tests cover SARIF quality and failure cases, while workflow trigger coverage and shell-based workflow assertions are expanded.

Changes

CodeQL SARIF security scanning

Layer / File(s) Summary
SARIF validation and coverage
cli/release-automation/internal/automation/..., cli/release-automation/internal/automation/testdata/...
Adds CodeQL SARIF schema, execution, and quality validation with fixtures and acceptance, rejection, and warning tests.
CodeQL workflow integration
.github/workflows/security-scan.yml, cli/release-automation/cmd/check-codeql-sarif/...
Replaces the previous C# scan flow with CodeQL analysis, Go-based SARIF validation, and conditional verified-result upload.
Workflow triggers and assertions
.github/workflows/security-scan.yml, scripts/test-security-scan-workflow.sh, .github/workflows/build-and-test.yml, docs/security-scan-engine-decision.md
Expands workflow path filters, documents the scan-engine decision, and adds assertions for required configuration, forbidden legacy behavior, and step ordering; the new script is included in helper tests.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant CodeQL
  participant SARIFGuard
  participant GitHubCodeScanning
  GitHubActions->>CodeQL: Analyze C# code
  CodeQL-->>GitHubActions: Generate SARIF
  GitHubActions->>SARIFGuard: Validate SARIF
  SARIFGuard-->>GitHubActions: Return validation result
  GitHubActions->>GitHubCodeScanning: Upload verified SARIF
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly summarizes the main change: failing closed when C# security scanning fails.
Description check ✅ Passed The description is directly related to the CodeQL security-scan workflow and guard changes in this PR.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/codeql-security-scan

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-advanced-security

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
cli/release-automation/internal/automation/codeql_sarif_guard_test.go (1)

212-214: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

intJSON helper only supports 0-99.

Fine for current test values, but silently breaks for 100 (a natural boundary for a percentage) since rune('0'+10) is not a digit.

♻️ Suggested fix
-func intJSON(value int) string {
-	return string(rune('0'+value/10)) + string(rune('0'+value%10))
-}
+func intJSON(value int) string {
+	return strconv.Itoa(value)
+}

(requires importing strconv)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cli/release-automation/internal/automation/codeql_sarif_guard_test.go` around
lines 212 - 214, Update the intJSON helper to serialize arbitrary integer values
correctly, including 100 and larger, by using strconv rather than manually
constructing two digits. Add the required import and preserve the helper’s
string return contract.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/security-scan.yml:
- Around line 62-65: Update the CodeQL paths configuration in the security scan
workflow to include all repository directories containing C# sources, including
Assets/Editor, Assets/Scenes, tools/, and tests/, while retaining the existing
Packages/src and Assets/Tests coverage.

---

Nitpick comments:
In `@cli/release-automation/internal/automation/codeql_sarif_guard_test.go`:
- Around line 212-214: Update the intJSON helper to serialize arbitrary integer
values correctly, including 100 and larger, by using strconv rather than
manually constructing two digits. Add the required import and preserve the
helper’s string return contract.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: df5e8dc3-9c38-4b5d-a32d-d22c10768268

📥 Commits

Reviewing files that changed from the base of the PR and between 7ee46c7 and 5aba044.

📒 Files selected for processing (7)
  • .github/workflows/build-and-test.yml
  • .github/workflows/security-scan.yml
  • cli/release-automation/cmd/check-codeql-sarif/main.go
  • cli/release-automation/internal/automation/codeql_sarif_guard.go
  • cli/release-automation/internal/automation/codeql_sarif_guard_test.go
  • cli/release-automation/internal/automation/testdata/codeql-cli-2.26.0-sarif.json
  • scripts/test-security-scan-workflow.sh

Comment thread .github/workflows/security-scan.yml
hatayama added 2 commits July 15, 2026 18:50
Keep extractor-collapse thresholds fail closed while surfacing movement below
the approved proof baseline as a nonblocking GitHub Actions warning.
Record the real security-extended probe and scanner selection evidence so the
workflow cannot rely on synthetic zero-result SARIF alone.
Use decimal conversion for all quality percentages so future 100% fixtures remain valid, and record why expanding beyond the approved package corpus requires a separate baseline review.
@hatayama

Copy link
Copy Markdown
Owner Author

@coderabbitai review

Review follow-up is in commit 54f4f8f9: the percentage fixture now covers 100 via strconv.Itoa, and the approved package scan corpus remains unchanged with repository-wide C# expansion recorded as separately reviewed future work.

@coderabbitai

coderabbitai Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
cd /repo 2>/dev/null || true
git fetch origin pull/1792/head:pr1792 2>&1 | tail -5
git log --oneline -5 pr1792 2>&1
git show 54f4f8f9 --stat 2>&1 | head -50
git show 54f4f8f9 -- cli/release-automation/internal/automation/codeql_sarif_guard_test.go 2>&1 | head -200

Length of output: 2619


@hatayama Thanks for the update. I confirmed commit 54f4f8f9:

  • intJSON in cli/release-automation/internal/automation/codeql_sarif_guard_test.go now uses strconv.Itoa(value) instead of the previous manual two-digit rune concatenation, so it correctly formats 100% (and any other 3-digit value) instead of producing an incorrect string.
  • The new TestIntJSONFormatsThreeDigitValues test locks in this behavior.
  • docs/security-scan-engine-decision.md now documents that expanding validation beyond the approved package corpus to repository-wide C# is deferred as separately reviewed future work.

This resolves the earlier concern about the fixture helper breaking on 100% values. Kicking off a fresh review of the PR now.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@hatayama
hatayama merged commit bc8be01 into security/cli-distribution-hardening-integration Jul 15, 2026
5 checks passed
@hatayama
hatayama deleted the fix/codeql-security-scan branch July 15, 2026 10:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants