CodeQL #258
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | ||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| branches: [main] | ||
| schedule: | ||
| # Weekly Tuesday 04:29 UTC — outside business hours, decoupled from | ||
| # the Monday dependency-check window. | ||
| - cron: "29 4 * * 2" | ||
| workflow_dispatch: {} | ||
| permissions: | ||
| contents: read | ||
| # CodeQL v4.36.3 reads workflow-run metadata in the post-processing step | ||
| # that enriches SARIF with run fingerprints (see job log line "Adding | ||
| # fingerprints to SARIF file"). Without `actions: read` the action exits | ||
| # with "Resource not accessible by integration - workflow-runs#get-a- | ||
| # workflow-run" AFTER analysis is already done — the SARIF is correct | ||
| # but the job is marked failed. `actions: read` is the minimum required | ||
| # to let CodeQL inspect its own run; it does NOT widen privileges | ||
| # beyond reading public workflow metadata. | ||
| actions: read | ||
| # Public repositories can publish CodeQL SARIF to GitHub code scanning. | ||
| # `security-events: write` is the least privilege required by CodeQL | ||
| # upload; results then appear as code scanning alerts instead of only as | ||
| # workflow artifacts. | ||
| security-events: write | ||
| concurrency: | ||
| group: codeql-${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| analyze: | ||
| name: Analyze (${{ matrix.os }} / ${{ matrix.language }}) | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| os: [ubuntu-latest] | ||
| language: ["javascript-typescript", "python"] | ||
| uses: NDDev-it-com/nddev-ci-workflows/.github/workflows/public-codeql.yml@ac4d1f469f5974741c7449305ffcbd5f05a5a47f # 0.5.1 | ||
|
Check failure on line 43 in .github/workflows/codeql.yml
|
||
| with: | ||
| runner: ${{ matrix.os }} | ||
| languages: '["${{ matrix.language }}"]' | ||
| config_file: ./.github/codeql/codeql-config.yml | ||
| autobuild: true | ||
| output_directory: codeql-results | ||
| upload_sarif_artifact: true | ||
| artifact_name: codeql-${{ matrix.os }}-${{ matrix.language }}-sarif | ||
