ci: update CodeQL workflow actions and add Dependabot monitoring by jkmassel · Pull Request #413 · wordpress-mobile/GutenbergKit

jkmassel · 2026-04-02T01:52:26Z

Summary

Bump actions/checkout from v4 to v5
Bump github/codeql-action (init, autobuild, analyze) from v3 to v4
Add github-actions ecosystem to Dependabot to automatically track future action version updates

Resolves GitHub Actions deprecation warnings for Node.js 20. Both v5 (checkout) and v4 (codeql-action) are drop-in replacements with no breaking changes for this workflow.

Test plan

Verify CodeQL workflow runs successfully on this PR
Confirm no Node.js deprecation warnings in workflow logs

🤖 Generated with Claude Code

Bump actions/checkout v4 → v5 and github/codeql-action v3 → v4 to resolve GitHub Actions Node.js 20 deprecation warnings. Node.js 20 actions will be forced to Node.js 24 starting June 2, 2026. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add `github-actions` package ecosystem to dependabot.yml so action version updates (checkout, codeql-action, etc.) are tracked automatically alongside npm dependencies. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Set build-mode: none for the interpreted languages job (actions, java-kotlin, javascript-typescript) and remove the autobuild step. This ensures CodeQL extracts all Kotlin source files rather than only those reachable from a single Gradle build (51/90 previously). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Change from building only GutenbergKit and GutenbergKitHTTP to building all targets including tests. Previously only 11/132 Swift files were scanned. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add xcodebuild step for the Demo-iOS Xcode project so its 14 Swift files are also scanned by CodeQL. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

java-kotlin requires compilation and cannot use build-mode: none. Use a matrix include to set the build mode per language: autobuild for java-kotlin, none for actions and javascript-typescript. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Autobuild only compiled 51/90 Kotlin files. Replace it with a dedicated job that runs compileDebugSources, compileDebugTestSources, and compileDebugAndroidTestSources across both modules to ensure full coverage. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Use `compileDebugUnitTestSources` instead of the ambiguous `compileDebugTestSources` which matches both unit and Android test source sets. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The compileDebugAndroidTestSources task fails because Espresso Web and Compose test dependencies aren't available on the CI runner. These instrumentation tests in the demo app aren't useful targets for static security analysis, so just compile main and unit test sources. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dcalhoun

While I do not see any deprecation warnings in the CI logs, it appears the Swift CodeQL task continues to cancel due to a timeout. Here is Claude's analysis. WDYT is the most appropriate solution?

Claude analysis

Root Cause

The analyze-swift job is hitting its 30-minute timeout (codeql.yml:67). The swift build --build-tests step alone takes ~29.5 minutes, leaving no time for the subsequent "Build Demo app" step. The build got to 277/279 compilations before being killed.

Two factors contribute to the long build time:

SPM dependency resolution is slow — computing the version for SVGView.git alone took 531 seconds (~9 minutes). This is a known issue with SPM when using from: ranges on repos with many tags — SPM checks every tag to find compatible versions.
The build itself is large — compiling all targets including tests (279 compilation units total) plus all dependencies (SwiftSoup, SVGView, GutenbergKitHTTP, etc.) takes ~20 minutes.

And the "Build Demo app" xcodebuild step would add even more time on top of that.

Fix Options

Option 1 (simplest): Increase the timeout

Bump timeout-minutes from 30 to 60 on the analyze-swift job. This gives enough headroom for both build steps plus the CodeQL analysis step.

Option 2 (also helps): Remove --build-tests

Change swift build --build-tests to just swift build. CodeQL only needs the source code compiled for analysis — test code is typically not what you want to scan for security vulnerabilities. This would cut out ~50 compilation units and save several minutes.

Option 3 (complementary): Remove the Demo app build

The Demo app build adds more compilation time. If the Swift package build already covers the main library code, the Demo app step may be redundant for CodeQL's purposes.

The swift build + Demo app xcodebuild completes but takes ~30m on macos-15 runners, hitting the timeout boundary during the Demo app build step. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

SPM version resolution takes ~9 minutes on a cold CI cache because it clones each dependency mirror and parses Package.swift for every candidate version. Caching the SPM repository mirrors across runs avoids this. Also removes a stale wordpress-rs pin from Package.resolved — it's not in Package.swift and shouldn't be resolved. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

swift build --build-tests compiles test targets that import UIKit, which isn't available when building for macOS on CI. The library targets are sufficient for CodeQL analysis. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Updates the repository’s security/CI automation by modernizing the CodeQL workflow action versions and enabling Dependabot to track future GitHub Actions updates, while also adjusting how CodeQL builds/analysis are executed for different languages.

Changes:

Bump actions/checkout to v5 and github/codeql-action steps to v4.
Restructure CodeQL workflow: split Kotlin into a dedicated job with an explicit Gradle build; adjust Swift job (SPM caching, broader builds, longer timeout); remove CodeQL autobuild for interpreted languages and set build-mode: none.
Add Dependabot updates for the github-actions ecosystem.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
`Package.resolved`	Updates SwiftPM lock state and removes an unused/stray pin (`wordpress-rs`).
`.github/workflows/codeql.yml`	Upgrades actions and changes CodeQL job structure/build behavior across languages.
`.github/dependabot.yml`	Enables Dependabot monitoring for GitHub Actions version updates.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-29T10:01:25Z

+    analyze-kotlin:
+        name: Analyze (java-kotlin)
+        runs-on: ubuntu-latest
+        timeout-minutes: 30
+
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v5
+
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@v4
+              with:
+                  languages: java-kotlin
+
+            - name: Build Android project
+              run: cd android && ./gradlew compileDebugSources compileDebugUnitTestSources
+


This PR introduces additional workflow behavior beyond version bumps: it splits out a new analyze-kotlin job and adds an explicit Android Gradle build step. Please call this out in the PR description/test plan (it can affect CI time/failure modes) so reviewers understand the scope increase.

Copilot · 2026-04-29T10:01:26Z

            - name: Initialize CodeQL
-              uses: github/codeql-action/init@v3
+              uses: github/codeql-action/init@v4
              with:
                  languages: ${{ matrix.language }}
-
-            - name: Autobuild
-              uses: github/codeql-action/autobuild@v3
+                  build-mode: none


The PR description claims only action bumps with no behavioral changes, but this workflow change also removes the CodeQL autobuild step and explicitly sets build-mode: none for the interpreted-language matrix. Please update the PR description/test plan to reflect these workflow behavior changes (and confirm they don’t reduce JS/TS extraction coverage compared to the previous autobuild-based setup).

iangmaia · 2026-04-29T12:37:25Z

+              run: swift build
+
+            - name: Build Demo app
+              run: xcodebuild build -project ios/Demo-iOS/Gutenberg.xcodeproj -scheme Gutenberg -destination 'generic/platform=iOS' CODE_SIGNING_ALLOWED=NO


💭 Just wondering, would it make sense to check in the Demo app Package.resolved, now that this job builds the Xcode project? That would make dependency resolution for this step reproducible.

github-actions Bot added the [Type] Build Tooling Issues or PRs related to build tooling label Apr 2, 2026

ci: add Dependabot monitoring for GitHub Actions

a9e5b4f

Add `github-actions` package ecosystem to dependabot.yml so action version updates (checkout, codeql-action, etc.) are tracked automatically alongside npm dependencies. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jkmassel changed the title ~~ci: update CodeQL workflow to Node.js 24-compatible actions~~ ci: update CodeQL workflow actions and add Dependabot monitoring Apr 2, 2026

jkmassel requested review from a team and dcalhoun April 2, 2026 01:54

jkmassel self-assigned this Apr 2, 2026

jkmassel and others added 7 commits April 1, 2026 20:31

ci: build all Swift targets for CodeQL analysis

f5b68f3

Change from building only GutenbergKit and GutenbergKitHTTP to building all targets including tests. Previously only 11/132 Swift files were scanned. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ci: include Demo app in CodeQL Swift analysis

99ff8e7

Add xcodebuild step for the Demo-iOS Xcode project so its 14 Swift files are also scanned by CodeQL. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ci: fix ambiguous Gradle task name in CodeQL workflow

23360a8

Use `compileDebugUnitTestSources` instead of the ambiguous `compileDebugTestSources` which matches both unit and Android test source sets. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

dcalhoun reviewed Apr 2, 2026

View reviewed changes

jkmassel and others added 3 commits April 15, 2026 12:19

ci: increase Swift CodeQL timeout from 30m to 45m

b2e4477

The swift build + Demo app xcodebuild completes but takes ~30m on macos-15 runners, hitting the timeout boundary during the Demo app build step. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ci: drop --build-tests from Swift CodeQL build

9e0f913

swift build --build-tests compiles test targets that import UIKit, which isn't available when building for macOS on CI. The library targets are sufficient for CodeQL analysis. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

iangmaia requested a review from Copilot April 29, 2026 09:57

Copilot started reviewing on behalf of iangmaia April 29, 2026 09:58 View session

Copilot AI reviewed Apr 29, 2026

View reviewed changes

iangmaia reviewed Apr 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: update CodeQL workflow actions and add Dependabot monitoring#413

ci: update CodeQL workflow actions and add Dependabot monitoring#413
jkmassel wants to merge 12 commits intotrunkfrom
jkmassel/update-codeql-v4

jkmassel commented Apr 2, 2026 •

edited

Loading

Uh oh!

dcalhoun left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

iangmaia Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

jkmassel commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

dcalhoun left a comment

Choose a reason for hiding this comment

Root Cause

Fix Options

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

iangmaia Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jkmassel commented Apr 2, 2026 •

edited

Loading