codeql #845
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CodeQL — semantic SAST. | |
| # | |
| # We scan two languages here: | |
| # - rust : the daemon source (CodeQL Rust support is GA). | |
| # - actions : the workflow definitions in this very directory (catches | |
| # unpinned actions, script injection, untrusted env input). | |
| # | |
| # Findings land in the Security tab and gate PRs on critical severity. | |
| name: codeql | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| branches: [master] | |
| schedule: | |
| # Weekly run picks up newly-shipped query packs even when the code is idle. | |
| - cron: "30 4 * * 1" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: codeql-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/master' }} | |
| jobs: | |
| analyze: | |
| name: CodeQL (${{ matrix.language }}) | |
| runs-on: [self-hosted, Linux, X64] | |
| timeout-minutes: 60 | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Rust: CodeQL's Rust extractor uses `build-mode: none` and runs | |
| # its own extraction step — `manual` is no longer accepted as of | |
| # CodeQL 2.25: | |
| # "Rust does not support the manual build mode. Please try | |
| # using one of the following build modes instead: none." | |
| - language: rust | |
| build-mode: none | |
| - language: actions | |
| build-mode: none | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| queries: security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" |