kumarUjjawal opened a new pull request, #25587: URL: https://github.com/apache/datafusion/pull/25587
## Which issue does this PR close? Part of #21048. ## Rationale for this change `./dev/rust_lint.sh` runs the non-functional CI checks locally. The CodeQL analysis for GitHub Actions was the one security check that a contributor could not run before a push. ## What changes are included in this PR? `ci/scripts/check_codeql_actions.sh` runs the default CodeQL query suite for GitHub Actions and writes a SARIF report under `target/codeql-actions/`. This PR registers the script in `dev/rust_lint.sh` and documents it in the testing guide. The script needs the complete CodeQL bundle on `PATH`. It fails with setup guidance when CodeQL is absent. It does not upload results. `.github/workflows/codeql.yml` does not change. ## What is the testing strategy for this PR? The check ran against this repository with CodeQL CLI 2.27.0, the version that the pinned `github/codeql-action` commit uses. It scanned 18 of 18 Actions files and found no problems. The hosted run on the same commit used the same CLI and the same `codeql/actions-queries` 0.6.35 pack, and also reported 18 of 18 files. A disposable fixture with a workflow that has no `permissions` block produced the expected finding in the local report. ## Are there any user-facing changes? No. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
