vogt/.github/workflows/codeql.yml at main · TheDancingDeveloper-org/vogt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: codeql

# Repository-owned code scanning for all three implementation languages.
# This starts as an independent check: once the self-hosted runner has
# produced a receipt for every matrix entry it can be added to branch
# protection without turning runner/tool-download uncertainty into a merge
# outage.

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron: "23 3 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  analyze:
    name: analyze (${{ matrix.language }})
    runs-on: [self-hosted]
    timeout-minutes: 45
    concurrency:
      # Newest-wins: an analysis of a superseded commit is fully covered by
      # the analysis that replaces it — CodeQL scans the whole tree, so
      # cancelling loses nothing on any event.
      group: codeql-${{ github.ref }}-${{ matrix.language }}
      cancel-in-progress: true
    permissions:
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language:
          - python
          - javascript-typescript
          - rust
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      # The Actions runtime bundles Node for action execution, but the
      # JavaScript/TypeScript extractor starts `node` from PATH. The
      # self-hosted base runner deliberately has no language runtimes.
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
        if: matrix.language == 'javascript-typescript'
        with:
          node-version: "22"

      # Rust, Python, and JavaScript/TypeScript all support build-mode none in
      # the current CodeQL bundle. That keeps this security analysis separate
      # from the authoritative build/test jobs and avoids rebuilding the PWA
      # or engine only to extract source a second time.
      - uses: github/codeql-action/init@6f5948dfacef28e207b48d0905cf90c03365536d
        with:
          languages: ${{ matrix.language }}
          build-mode: none
          # Query suite and path scope (test exclusions) live in the config
          # file so they are described once, with rationale, rather than inline.
          config-file: ./.github/codeql/codeql-config.yml

      - uses: github/codeql-action/analyze@6f5948dfacef28e207b48d0905cf90c03365536d
        with:
          category: /language:${{ matrix.language }}