dependabot[bot]
9fc2640b41
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v3...v4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
83 lines
2.8 KiB
YAML
83 lines
2.8 KiB
YAML
name: "CodeQL"
|
|
run-name: ${{ github.event.inputs.code_scanning_run_name }}
|
|
on: [push, pull_request, workflow_dispatch]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
CODE_SCANNING_REF: ${{ github.event.inputs.code_scanning_ref }}
|
|
CODE_SCANNING_BASE_BRANCH: ${{ github.event.inputs.code_scanning_base_branch }}
|
|
CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH: ${{ github.event.inputs.code_scanning_is_analyzing_default_branch }}
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ${{ fromJSON(matrix.runner) }}
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
packages: read
|
|
security-events: write
|
|
continue-on-error: false
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: actions
|
|
category: /language:actions
|
|
build-mode: none
|
|
runner: '["ubuntu-22.04"]'
|
|
- language: go
|
|
category: /language:go
|
|
build-mode: autobuild
|
|
runner: '["ubuntu-22.04"]'
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v5
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v4
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
dependency-caching: ${{ runner.environment == 'github-hosted' }}
|
|
queries: "" # Default query suite
|
|
packs: github/ccr-${{ matrix.language }}-queries
|
|
config: |
|
|
default-setup:
|
|
org:
|
|
model-packs: [ ${{ github.event.inputs.code_scanning_codeql_packs }} ]
|
|
threat-models: [ ]
|
|
- name: Setup proxy for registries
|
|
id: proxy
|
|
uses: github/codeql-action/start-proxy@v4
|
|
with:
|
|
registries_credentials: ${{ secrets.GITHUB_REGISTRIES_PROXY }}
|
|
language: ${{ matrix.language }}
|
|
|
|
- name: Configure
|
|
uses: github/codeql-action/resolve-environment@v4
|
|
id: resolve-environment
|
|
with:
|
|
language: ${{ matrix.language }}
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v6
|
|
if: matrix.language == 'go' && fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version
|
|
with:
|
|
go-version: ${{ fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version }}
|
|
cache: false
|
|
|
|
- name: Autobuild
|
|
uses: github/codeql-action/autobuild@v4
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@v4
|
|
env:
|
|
CODEQL_PROXY_HOST: ${{ steps.proxy.outputs.proxy_host }}
|
|
CODEQL_PROXY_PORT: ${{ steps.proxy.outputs.proxy_port }}
|
|
CODEQL_PROXY_CA_CERTIFICATE: ${{ steps.proxy.outputs.proxy_ca_certificate }}
|
|
with:
|
|
category: ${{ matrix.category }}
|