refactor: even also check actions by CodeQL #4623
Conversation
|
🔭🐙🐈 Test this branch here: https://db-ux-design-system.github.io/core-web/review/refactor-even-also-check-actions-by-CodeQL |
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
mfranzke
added
the
🍒 cherryPick
| # or others). This is typically only required for manual builds. | ||
| # - name: Setup runtime (example) | ||
| # uses: actions/setup-example@v1 | ||
| - name: Setup Node.js |
There was a problem hiding this comment.
This generated code from copilot...
Why do we need to install the dependencies here?
There was a problem hiding this comment.
Pull Request Overview
This PR refactors the CodeQL analysis workflow to analyze both JavaScript/TypeScript and GitHub Actions code instead of just JavaScript. The changes enable comprehensive static analysis across different code types in the repository.
- Expanded CodeQL analysis to cover GitHub Actions workflows in addition to JavaScript/TypeScript code
- Added Node.js setup and dependency installation steps to support proper analysis
- Updated workflow configuration to use matrix strategy with multiple languages and build modes
| - name: 🔄 Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| build-mode: ${{ matrix.build-mode }} |
There was a problem hiding this comment.
The build-mode parameter should be nested under the with: key, not at the same level as languages. This will cause the workflow to fail as build-mode is not a valid top-level parameter for the init action.
| build-mode: ${{ matrix.build-mode }} | |
| build-mode: none |
Copilot uses AI. Check for mistakes.
Proposed changes
We want to check both the JavaScript and the GitHub Actions code using CodeQL.
Types of changes
Further comments