action-security-code-scanner/.github/workflows/reusable-codeql.yml at 7f0b93c0004cff49ec42f9c2a41da62543678fdb · MetaMask/action-security-code-scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
name: 'Reusable CodeQL Analysis'

on:
  workflow_call:
    inputs:
      languages:
        description: 'JSON array of programming languages to scan (e.g., ["javascript", "python"])'
        required: true
        type: string
      repo:
        description: 'Repository that requested the scan'
        required: true
        type: string
      paths_ignored:
        description: 'Comma delimited paths to ignore during scan'
        required: false
        type: string
        default: ''
      rules_excluded:
        description: 'Comma delimited IDs of rules to exclude'
        required: false
        type: string
        default: ''
    outputs:
      sarif-id:
        description: 'SARIF file identifier'
        value: ${{ jobs.codeql-analysis.outputs.sarif-id }}

jobs:
  codeql-analysis:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: ${{ fromJSON(inputs.languages) }}

    outputs:
      sarif-id: ${{ steps.upload.outputs.sarif-id }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          repository: ${{ inputs.repo }}
          path: ${{ inputs.repo }}

      - name: Call Security Code Scanner CodeQL Action
        id: codeql-scan
        uses: ./packages/codeql-action@main
        with:
          repo: ${{ inputs.repo }}
          language: ${{ matrix.language }}
          paths_ignored: ${{ inputs.paths_ignored }}
          rules_excluded: ${{ inputs.rules_excluded }}

      - name: Upload SARIF with language suffix
        id: upload
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.codeql-scan.outputs.sarif-output }}
          category: codeql-${{ matrix.language }}