Skip to content

Commit 57d79fa

Browse files
ccampanaleccampanale
authored
Merge pull request #158 from niaid/ghasctl-1773207681
Updating GitHub Code Scanning Workflows
2 parents e38f159 + 80a4534 commit 57d79fa

File tree

4 files changed

+210
-0
lines changed

4 files changed

+210
-0
lines changed

‎.github/workflows/codeql-analysis-java.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
2+
3+
name: "CodeQL Java/Kotlin"
4+
5+
on:
6+
push:
7+
branches: ["master", "main"]
8+
pull_request:
9+
# The branches below must be a subset of the branches above
10+
branches: ["master", "main"]
11+
schedule:
12+
- cron: "27 4 * * 5"
13+
14+
jobs:
15+
analyze:
16+
name: Analyze
17+
runs-on: ubuntu-latest
18+
permissions:
19+
actions: read
20+
contents: read
21+
security-events: write
22+
packages: read
23+
# required to fetch internal or private CodeQL packs
24+
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
language: ["java-kotlin"]
29+
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@v5
33+
34+
# Initializes the CodeQL tools for scanning.
35+
- name: Initialize CodeQL
36+
uses: github/codeql-action/init@v4
37+
with:
38+
languages: ${{ matrix.language }}
39+
queries: security-extended # security-and-quality
40+
# If you wish to specify custom queries, you can do so here or in a config file.
41+
# By default, queries listed here will override any specified in a config file.
42+
# Prefix the list here with "+" to use these queries and those in the config file.
43+
build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too.
44+
# CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
45+
# Use `c-cpp` to analyze code written in C, C++ or both
46+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
47+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
48+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
49+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
50+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
51+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
52+
53+
# # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
54+
# # If this step fails, then you should remove it and run the build manually (see below)
55+
# - name: Autobuild
56+
# uses: github/codeql-action/autobuild@v4
57+
58+
# ℹ️ Command-line programs to run using the OS shell.
59+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
60+
61+
# If the Autobuild fails above, remove it and uncomment the following three lines.
62+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
63+
64+
# - run: |
65+
# echo "Run, Build Application using script"
66+
# ./location_of_script_within_repo/buildscript.sh
67+
68+
- name: Perform CodeQL Analysis
69+
uses: github/codeql-action/analyze@v4
70+
with:
71+
category: "/language:${{matrix.language}}"
72+

‎.github/workflows/codeql-analysis-javascript.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
2+
3+
name: "CodeQL JavaScript/TypeScript"
4+
5+
on:
6+
push:
7+
branches: ["master", "main"]
8+
pull_request:
9+
# The branches below must be a subset of the branches above
10+
branches: ["master", "main"]
11+
schedule:
12+
- cron: "27 4 * * 5"
13+
14+
jobs:
15+
analyze:
16+
name: Analyze
17+
runs-on: ubuntu-latest
18+
permissions:
19+
actions: read
20+
contents: read
21+
security-events: write
22+
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
language: ["javascript"]
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@v5
31+
32+
# Initializes the CodeQL tools for scanning.
33+
- name: Initialize CodeQL
34+
uses: github/codeql-action/init@v4
35+
with:
36+
languages: ${{ matrix.language }}
37+
queries: security-extended # security-and-quality
38+
# If you wish to specify custom queries, you can do so here or in a config file.
39+
# By default, queries listed here will override any specified in a config file.
40+
# Prefix the list here with "+" to use these queries and those in the config file.
41+
42+
- name: Perform CodeQL Analysis
43+
uses: github/codeql-action/analyze@v4
44+
with:
45+
category: "/language:${{matrix.language}}"
46+

‎.github/workflows/codeql-analysis-python.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
2+
3+
name: "CodeQL Python"
4+
5+
on:
6+
push:
7+
branches: ["master", "main"]
8+
pull_request:
9+
# The branches below must be a subset of the branches above
10+
branches: ["master", "main"]
11+
schedule:
12+
- cron: "27 4 * * 5"
13+
14+
jobs:
15+
analyze:
16+
name: Analyze
17+
runs-on: ubuntu-latest
18+
permissions:
19+
actions: read
20+
contents: read
21+
security-events: write
22+
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
language: ["python"]
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@v5
31+
32+
# Initializes the CodeQL tools for scanning.
33+
- name: Initialize CodeQL
34+
uses: github/codeql-action/init@v4
35+
with:
36+
languages: ${{ matrix.language }}
37+
queries: security-extended # security-and-quality
38+
# If you wish to specify custom queries, you can do so here or in a config file.
39+
# By default, queries listed here will override any specified in a config file.
40+
# Prefix the list here with "+" to use these queries and those in the config file.
41+
42+
- name: Perform CodeQL Analysis
43+
uses: github/codeql-action/analyze@v4
44+
with:
45+
category: "/language:${{matrix.language}}"
46+

‎.github/workflows/codeql-analysis-ruby.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
2+
3+
name: "CodeQL Ruby"
4+
5+
on:
6+
push:
7+
branches: ["master", "main"]
8+
pull_request:
9+
# The branches below must be a subset of the branches above
10+
branches: ["master", "main"]
11+
schedule:
12+
- cron: "27 4 * * 5"
13+
14+
jobs:
15+
analyze:
16+
name: Analyze
17+
runs-on: ubuntu-latest
18+
permissions:
19+
actions: read
20+
contents: read
21+
security-events: write
22+
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
language: ["ruby"]
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@v5
31+
32+
# Initializes the CodeQL tools for scanning.
33+
- name: Initialize CodeQL
34+
uses: github/codeql-action/init@v4
35+
with:
36+
languages: ${{ matrix.language }}
37+
queries: security-extended # security-and-quality
38+
# If you wish to specify custom queries, you can do so here or in a config file.
39+
# By default, queries listed here will override any specified in a config file.
40+
# Prefix the list here with "+" to use these queries and those in the config file.
41+
42+
- name: Perform CodeQL Analysis
43+
uses: github/codeql-action/analyze@v4
44+
with:
45+
category: "/language:${{matrix.language}}"
46+

0 commit comments

Comments
 (0)