1- # For most projects, this workflow file will not need changing; you simply need
2- # to commit it to your repository.
3- #
4- # You may wish to alter this file to override the set of languages analyzed,
5- # or to provide custom queries or build logic.
6- #
7- # ******** NOTE ********
8- # We have attempted to detect the languages in your repository. Please check
9- # the `language` matrix defined below to confirm you have the correct set of
10- # supported CodeQL languages.
11- #
121name : codeql
132
143on :
209 schedule :
2110 - cron : ' 18 13 * * 6'
2211
12+ permissions :
13+ contents : read
14+
2315jobs :
2416 analyze :
2517 timeout-minutes : 10
@@ -33,44 +25,22 @@ jobs:
3325 fail-fast : false
3426 matrix :
3527 language : [ 'go' ]
36- # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
37- # Learn more:
38- # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
39-
4028 steps :
29+ - name : Harden Runner
30+ uses : step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
31+ with :
32+ egress-policy : audit
4133 - name : Checkout repository
4234 uses : actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
43-
44- - name : Setup Go
45- uses : actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
35+ - name : Install Go
36+ uses : actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
4637 with :
4738 go-version-file : go.mod
48-
49- # Initializes the CodeQL tools for scanning.
5039 - name : Initialize CodeQL
51- uses : github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
40+ uses : github/codeql-action/init@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
5241 with :
5342 languages : ${{ matrix.language }}
54- # If you wish to specify custom queries, you can do so here or in a config file.
55- # By default, queries listed here will override any specified in a config file.
56- # Prefix the list here with "+" to use these queries and those in the config file.
57- # queries: ./path/to/local/query, your-org/your-repo/queries@main
58-
59- # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
60- # If this step fails, then you should remove it and run the build manually (see below)
6143 - name : Autobuild
62- uses : github/codeql-action/autobuild@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
63-
64- # ℹ️ Command-line programs to run using the OS shell.
65- # 📚 https://git.io/JvXDl
66-
67- # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
68- # and modify them (or add more) to build your code if your project
69- # uses a compiled language
70-
71- # - run: |
72- # make bootstrap
73- # make release
74-
44+ uses : github/codeql-action/autobuild@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
7545 - name : Perform CodeQL Analysis
76- uses : github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
46+ uses : github/codeql-action/analyze@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
0 commit comments