Repository navigation
Merge updated main into fix/ci-426-batch15 #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | ||
| # This workflow is managed by gh actions-lock. | ||
| # codeql-reusable.yml — Reusable CodeQL security-analysis workflow. | ||
| # | ||
| # Consolidates the per-repo `codeql.yml` workflow (estate-wide: 263 | ||
| # deployments, 69 unique blob SHAs, 26% structural drift). Language | ||
| # matrix distribution across the estate: | ||
| # | ||
| # javascript-typescript 223 (84.8%) | ||
| # actions 22 (8.4%) | ||
| # NONE (no matrix declared) 6 (2.3%) | ||
| # rust 3 (1.1%) | ||
| # javascript-typescript,rust 3 (1.1%) | ||
| # actions,javascript-typescript 3 (1.1%) | ||
| # actions,javascript-typescript,rust 2 (0.8%) | ||
| # actions,rust 1 (0.4%) | ||
| # | ||
| # 100% of estate variants currently use `build-mode: none`. | ||
| # | ||
| # Design: single-language single-job reusable. Multi-language wrappers | ||
| # invoke the reusable once per language (parallel-by-construction). | ||
| # This avoids the matrix-as-input awkwardness while preserving per- | ||
| # language SARIF separation via the `category` step. | ||
| # | ||
| # Caller examples: | ||
| # | ||
| # # Single-language (~85% of estate): | ||
| # jobs: | ||
| # codeql: | ||
| # uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha> | ||
| # # defaults to language=javascript-typescript, build-mode=none | ||
| # | ||
| # # Rust-only: | ||
| # jobs: | ||
| # codeql: | ||
| # uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha> | ||
| # with: | ||
| # language: rust | ||
| # | ||
| # # Multi-language (JS/TS + actions + Rust): | ||
| # jobs: | ||
| # codeql-js: | ||
| # uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha> | ||
| # codeql-actions: | ||
| # uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha> | ||
| # with: | ||
| # language: actions | ||
| # codeql-rust: | ||
| # uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@<sha> | ||
| # with: | ||
| # language: rust | ||
| name: CodeQL Security Analysis (reusable) | ||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| language: | ||
| description: 'CodeQL language identifier (e.g. javascript-typescript, rust, actions). Single language per call; multi-language wrappers invoke the reusable once per language.' | ||
| type: string | ||
| required: false | ||
| default: javascript-typescript | ||
| build-mode: | ||
| description: 'CodeQL build mode (none|autobuild|manual). 100% of estate currently uses "none"; override only for compiled languages that require explicit build.' | ||
| type: string | ||
| required: false | ||
| default: none | ||
| runs-on: | ||
| timeout-minutes: 30 | ||
| description: 'Runner label for the analyze job' | ||
| type: string | ||
| required: false | ||
| default: ubuntu-latest | ||
| permissions: | ||
| actions: read | ||
| contents: read | ||
| jobs: | ||
| analyze: | ||
| timeout-minutes: 20 | ||
| runs-on: ${{ inputs.runs-on }} | ||
| timeout-minutes: 30 | ||
| # Job-level permissions inherit from workflow-level and ADD security-events: write. | ||
| # Do NOT narrow here or CodeQL action loses `actions: read` which it needs. | ||
| permissions: | ||
| actions: read | ||
| contents: read | ||
| security-events: write | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v3 | ||
| with: | ||
| languages: ${{ inputs.language }} | ||
| build-mode: ${{ inputs.build-mode }} | ||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v3 | ||
| with: | ||
| category: "/language:${{ inputs.language }}" | ||
