malkuthro
2babbafb6b
* chore(security): pin Actions and update aiohttp * fix(security): generate universal test lock * fix(security): harden relock safeguards
57 lines
1.7 KiB
YAML
57 lines
1.7 KiB
YAML
name: "CodeQL"
|
|
|
|
# Advanced setup (replaces GitHub "default setup"). We need a committed config
|
|
# so we can paths-ignore the vendored upstream WhatDreamsCost code — default
|
|
# setup does not read codeql-config.yml. See .github/codeql/codeql-config.yml.
|
|
#
|
|
# IMPORTANT: GitHub will not run this workflow while "default setup" for CodeQL
|
|
# is still enabled. Disable it once under Settings -> Code security -> CodeQL
|
|
# analysis -> Default setup -> Disable, then this workflow takes over.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: "23 6 * * 1"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write
|
|
packages: read
|
|
actions: read
|
|
contents: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: actions
|
|
build-mode: none
|
|
- language: javascript-typescript
|
|
build-mode: none
|
|
- language: python
|
|
build-mode: none
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3.37.6
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
config-file: ./.github/codeql/codeql-config.yml
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3.37.6
|
|
with:
|
|
category: "/language:${{ matrix.language }}"
|