Martin Vogel
88ed09838f
Same treatment as v4.37.3 (#1434): dependabot splits the codeql-action bump into init-only and analyze-only PRs (#1398, #1399 after their rebase to 4.37.4), but the two actions must run at the same version, so each split PR fails its own analyze job. SHA verified against the upstream v4.37.4 tag. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
44 lines
1.2 KiB
YAML
44 lines
1.2 KiB
YAML
name: CodeQL SAST
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
analyze:
|
|
runs-on: ubuntu-latest
|
|
# CodeQL needs security-events: write to upload results; scoped to this job so
|
|
# the workflow's top-level token stays read-only (Scorecard TokenPermissions).
|
|
permissions:
|
|
security-events: write
|
|
actions: read
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Install build dependencies
|
|
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
|
|
with:
|
|
languages: c-cpp
|
|
build-mode: manual
|
|
|
|
- name: Build for CodeQL analysis
|
|
run: scripts/build.sh
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
|
|
with:
|
|
category: "/language:c-cpp"
|