Adopt GitHub-native CI security and review tooling (CodeQL + CodeRabbit)
Open
@balajinvda is already working on this.
Since Jul 20, 2026.
- Dominant language
- Go
- Stars
- 218
- Forks
- 72
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 427
Description
Summary
The public mirror runs TruffleHog secret scanning (dsx) but lacks static
analysis and AI code review. Adopt the GitHub-native pair:
- CodeQL SAST via NVIDIA/dsx-github-actions (Go + Rust), non-blocking during rollout.
- CodeRabbit config (.coderabbit.yaml) with path filters and AGENTS.md-aligned review instructions.
Out of scope / follow-ups
- SonarQube: internal sonar.nvidia.com is not reachable from GitHub-hosted runners; SonarQube Cloud (sonarcloud.io) would need a dedicated org + token. CodeQL covers the SAST overlap, so Sonar is deferred.
- dsx security-container-scan (Grype/SBOM) against Bazel-built images.
- Extend CodeQL matrix to Java/Python and flip to a blocking gate after triage.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.