Skip to content

Commit 8037f32

Browse files
authored
Recreate codeql workflow
1 parent 74cb4f6 commit 8037f32

File tree

1 file changed

+83
-54
lines changed

1 file changed

+83
-54
lines changed

.github/workflows/codeql.yml

Lines changed: 83 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,100 @@
1-
name: 'Code Scanning - Action'
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL Advanced"
213

314
on:
415
push:
5-
branches:
6-
- main
16+
branches: [ "main" ]
717
pull_request:
8-
branches:
9-
- main
18+
branches: [ "main" ]
1019
schedule:
11-
# ┌───────────── minute (0 - 59)
12-
# │ ┌───────────── hour (0 - 23)
13-
# │ │ ┌───────────── day of the month (1 - 31)
14-
# │ │ │ ┌───────────── month (1 - 12 or JAN-DEC)
15-
# │ │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
16-
# │ │ │ │ │
17-
# │ │ │ │ │
18-
# │ │ │ │ │
19-
# * * * * *
20-
- cron: '30 1 * * 0'
21-
22-
permissions:
23-
contents: read
24-
25-
# Ensure scripts are run with pipefail. See:
26-
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
27-
defaults:
28-
run:
29-
shell: bash
20+
- cron: '19 8 * * 6'
3021

3122
jobs:
32-
CodeQL-Build:
33-
# CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
34-
runs-on: ubuntu-latest
35-
if: github.repository == 'microsoft/TypeScript-DOM-lib-generator'
36-
23+
analyze:
24+
name: Analyze (${{ matrix.language }})
25+
# Runner size impacts CodeQL analysis time. To learn more, please see:
26+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
27+
# - https://gh.io/supported-runners-and-hardware-resources
28+
# - https://gh.io/using-larger-runners (GitHub.com only)
29+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
30+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
3731
permissions:
3832
# required for all workflows
3933
security-events: write
4034

41-
steps:
42-
- name: Checkout repository
43-
uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
35+
# required to fetch internal or private CodeQL packs
36+
packages: read
37+
38+
# only required for workflows in private repositories
39+
actions: read
40+
contents: read
4441

45-
# Initializes the CodeQL tools for scanning.
46-
- name: Initialize CodeQL
47-
uses: github/codeql-action/init@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
48-
with:
49-
config-file: ./.github/codeql/codeql-configuration.yml
50-
# Override language selection by uncommenting this and choosing your languages
51-
# with:
52-
# languages: go, javascript, csharp, python, cpp, java
42+
strategy:
43+
fail-fast: false
44+
matrix:
45+
include:
46+
- language: actions
47+
build-mode: none
48+
- language: javascript-typescript
49+
build-mode: none
50+
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
51+
# Use `c-cpp` to analyze code written in C, C++ or both
52+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
53+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
54+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
55+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
56+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
57+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
58+
steps:
59+
- name: Checkout repository
60+
uses: actions/checkout@v4
5361

54-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
55-
# If this step fails, then you should remove it and run the build manually (see below).
56-
- name: Autobuild
57-
uses: github/codeql-action/autobuild@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
62+
# Add any setup steps before running the `github/codeql-action/init` action.
63+
# This includes steps like installing compilers or runtimes (`actions/setup-node`
64+
# or others). This is typically only required for manual builds.
65+
# - name: Setup runtime (example)
66+
# uses: actions/setup-example@v1
5867

59-
# ℹ️ Command-line programs to run using the OS shell.
60-
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
68+
# Initializes the CodeQL tools for scanning.
69+
- name: Initialize CodeQL
70+
uses: github/codeql-action/init@v3
71+
with:
72+
languages: ${{ matrix.language }}
73+
build-mode: ${{ matrix.build-mode }}
74+
# If you wish to specify custom queries, you can do so here or in a config file.
75+
# By default, queries listed here will override any specified in a config file.
76+
# Prefix the list here with "+" to use these queries and those in the config file.
6177

62-
# ✏️ If the Autobuild fails above, remove it and uncomment the following
63-
# three lines and modify them (or add more) to build your code if your
64-
# project uses a compiled language
78+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
79+
# queries: security-extended,security-and-quality
6580

66-
#- run: |
67-
# make bootstrap
68-
# make release
81+
# If the analyze step fails for one of the languages you are analyzing with
82+
# "We were unable to automatically build your code", modify the matrix above
83+
# to set the build mode to "manual" for that language. Then modify this step
84+
# to build your code.
85+
# ℹ️ Command-line programs to run using the OS shell.
86+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
87+
- if: matrix.build-mode == 'manual'
88+
shell: bash
89+
run: |
90+
echo 'If you are using a "manual" build mode for one or more of the' \
91+
'languages you are analyzing, replace this with the commands to build' \
92+
'your code, for example:'
93+
echo ' make bootstrap'
94+
echo ' make release'
95+
exit 1
6996
70-
- name: Perform CodeQL Analysis
71-
uses: github/codeql-action/analyze@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
97+
- name: Perform CodeQL Analysis
98+
uses: github/codeql-action/analyze@v3
99+
with:
100+
category: "/language:${{matrix.language}}"

0 commit comments

Comments
 (0)