From 50ee2c3bc4881fb1381481ef9af333c2bc7967b4 Mon Sep 17 00:00:00 2001 From: Sam Morrow Date: Mon, 7 Apr 2025 11:49:32 +0200 Subject: [PATCH] chore: add code scanning advanced setup yml --- .github/workflows/code-scanning.yml | 82 +++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) create mode 100644 .github/workflows/code-scanning.yml diff --git a/.github/workflows/code-scanning.yml b/.github/workflows/code-scanning.yml new file mode 100644 index 000000000..83d2c30be --- /dev/null +++ b/.github/workflows/code-scanning.yml @@ -0,0 +1,82 @@ +name: "CodeQL" +run-name: ${{ github.event.inputs.code_scanning_run_name }} +on: [push, pull_request, workflow_dispatch] + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +env: + CODE_SCANNING_REF: ${{ github.event.inputs.code_scanning_ref }} + CODE_SCANNING_BASE_BRANCH: ${{ github.event.inputs.code_scanning_base_branch }} + CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH: ${{ github.event.inputs.code_scanning_is_analyzing_default_branch }} + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ${{ fromJSON(matrix.runner) }} + permissions: + actions: read + contents: read + packages: read + security-events: write + continue-on-error: false + strategy: + fail-fast: false + matrix: + include: + - language: actions + category: /language:actions + build-mode: none + runner: '["ubuntu-22.04"]' + - language: go + category: /language:go + build-mode: autobuild + runner: '["ubuntu-22.04"]' + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + dependency-caching: ${{ runner.environment == 'github-hosted' }} + queries: "" # Default query suite + packs: github/ccr-${{ matrix.language }}-queries + config: | + default-setup: + org: + model-packs: [ ${{ github.event.inputs.code_scanning_codeql_packs }} ] + threat-models: [ ] + - name: Setup proxy for registries + id: proxy + uses: github/codeql-action/start-proxy@v3 + with: + registries_credentials: ${{ secrets.GITHUB_REGISTRIES_PROXY }} + language: ${{ matrix.language }} + + - name: Configure + uses: github/codeql-action/resolve-environment@v3 + id: resolve-environment + with: + language: ${{ matrix.language }} + - name: Setup Go + uses: actions/setup-go@v5 + if: matrix.language == 'go' && fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version + with: + go-version: ${{ fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version }} + cache: false + + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + env: + CODEQL_PROXY_HOST: ${{ steps.proxy.outputs.proxy_host }} + CODEQL_PROXY_PORT: ${{ steps.proxy.outputs.proxy_port }} + CODEQL_PROXY_CA_CERTIFICATE: ${{ steps.proxy.outputs.proxy_ca_certificate }} + with: + category: ${{ matrix.category }} pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy