Skip to content

Commit 70b8fdf

Browse files
iamjoemccormickiamjoemccormick
committed
ci: add codeql analysis workflow
Preemptively apply known workflow best practices CodeQL will recommend.
1 parent 0ddd24a commit 70b8fdf

File tree

5 files changed

+118
-5
lines changed

5 files changed

+118
-5
lines changed

‎.github/actions/package/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ runs:
55
using: "composite"
66
steps:
77
- name: Setup Rust Environment
8-
uses: moonrepo/setup-rust@v1
8+
uses: moonrepo/setup-rust@ede6de059f8046a5e236c94046823e2af11ca670 # v1
99
with:
1010
components: clippy
1111
targets: aarch64-unknown-linux-gnu

‎.github/workflows/checks.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,25 @@
11
name: Check
22
run-name: Check ${{ github.ref_name }} by @${{ github.actor }}
3-
on: [pull_request, workflow_call]
3+
on:
4+
pull_request:
5+
paths-ignore:
6+
- "**/*.md"
7+
workflow_call:
48
env:
59
# Cargo must use git cli for checkouts instead of builtin functionality to respect the repla
610
CARGO_NET_GIT_FETCH_WITH_CLI: true
711
jobs:
812
checks:
913
runs-on: ubuntu-latest
14+
permissions:
15+
contents: read
1016
env:
1117
CARGO_LOCKED: 1
1218
steps:
1319
- name: Checkout
1420
uses: actions/checkout@v4
1521
- name: Setup Rust
16-
uses: moonrepo/setup-rust@v1
22+
uses: moonrepo/setup-rust@ede6de059f8046a5e236c94046823e2af11ca670 # v1
1723
with:
1824
components: clippy
1925
bins: cargo-deny

‎.github/workflows/codeql.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL Advanced"
13+
14+
on:
15+
push:
16+
branches: ["main"]
17+
paths-ignore:
18+
- "**/*.md"
19+
pull_request:
20+
branches: ["main"]
21+
paths-ignore:
22+
- "**/*.md"
23+
schedule:
24+
- cron: "30 20 * * 1"
25+
26+
jobs:
27+
analyze:
28+
name: Analyze (${{ matrix.language }})
29+
# Runner size impacts CodeQL analysis time. To learn more, please see:
30+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
31+
# - https://gh.io/supported-runners-and-hardware-resources
32+
# - https://gh.io/using-larger-runners (GitHub.com only)
33+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
34+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
35+
permissions:
36+
# required for all workflows
37+
security-events: write
38+
39+
# required to fetch internal or private CodeQL packs
40+
packages: read
41+
42+
# only required for workflows in private repositories
43+
actions: read
44+
contents: read
45+
46+
strategy:
47+
fail-fast: false
48+
matrix:
49+
include:
50+
- language: actions
51+
build-mode: none
52+
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
53+
# Use `c-cpp` to analyze code written in C, C++ or both
54+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
55+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
56+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
57+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
58+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
59+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
60+
steps:
61+
- name: Checkout repository
62+
uses: actions/checkout@v4
63+
64+
# Add any setup steps before running the `github/codeql-action/init` action.
65+
# This includes steps like installing compilers or runtimes (`actions/setup-node`
66+
# or others). This is typically only required for manual builds.
67+
# - name: Setup runtime (example)
68+
# uses: actions/setup-example@v1
69+
70+
# Initializes the CodeQL tools for scanning.
71+
- name: Initialize CodeQL
72+
uses: github/codeql-action/init@v3
73+
with:
74+
languages: ${{ matrix.language }}
75+
build-mode: ${{ matrix.build-mode }}
76+
# If you wish to specify custom queries, you can do so here or in a config file.
77+
# By default, queries listed here will override any specified in a config file.
78+
# Prefix the list here with "+" to use these queries and those in the config file.
79+
80+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
81+
# queries: security-extended,security-and-quality
82+
83+
# If the analyze step fails for one of the languages you are analyzing with
84+
# "We were unable to automatically build your code", modify the matrix above
85+
# to set the build mode to "manual" for that language. Then modify this step
86+
# to build your code.
87+
# ℹ️ Command-line programs to run using the OS shell.
88+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
89+
- if: matrix.build-mode == 'manual'
90+
shell: bash
91+
run: |
92+
echo 'If you are using a "manual" build mode for one or more of the' \
93+
'languages you are analyzing, replace this with the commands to build' \
94+
'your code, for example:'
95+
echo ' make bootstrap'
96+
echo ' make release'
97+
exit 1
98+
99+
- name: Perform CodeQL Analysis
100+
uses: github/codeql-action/analyze@v3
101+
with:
102+
category: "/language:${{matrix.language}}"

‎.github/workflows/contributors.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ on:
1212
jobs:
1313
verify:
1414
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
1517
steps:
1618
- name: Check out code
1719
uses: actions/checkout@v3

‎.github/workflows/release.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ on:
99
env:
1010
# Cargo must use git cli for checkouts instead of builtin functionality to respect the repla
1111
CARGO_NET_GIT_FETCH_WITH_CLI: true
12+
permissions:
13+
# Required to publish releases.
14+
contents: write
1215
jobs:
1316
release:
1417
runs-on: ubuntu-latest
@@ -24,7 +27,7 @@ jobs:
2427
uses: ./.github/actions/package
2528
- name: Import GPG key
2629
id: import_gpg
27-
uses: crazy-max/ghaction-import-gpg@v6
30+
uses: crazy-max/ghaction-import-gpg@82a020f1f7f605c65dd2449b392a52c3fcfef7ef # v6
2831
with:
2932
gpg_private_key: ${{ secrets.PUBLICREPO_GPGPACKAGEKEY }}
3033
passphrase: ${{ secrets.PUBLICREPO_GPGPACKAGEPASSPHRASE }}
@@ -34,7 +37,7 @@ jobs:
3437
export GPG_TTY=$(tty)
3538
gpg --pinentry-mode loopback --passphrase ${{ secrets.PUBLICREPO_GPGPACKAGEPASSPHRASE }} --trust-model always --detach-sign -o checksums.txt.sig -r [email protected] checksums.txt
3639
- name: Create Release
37-
uses: ncipollo/release-action@v1
40+
uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 # v1
3841
with:
3942
artifacts: "target/package/*.deb,target/package/*.rpm,target/package/checksums*"
4043
allowUpdates: true

0 commit comments

Comments
 (0)