edge-microvisor-toolkit/.github/workflows/codeql.yml at 390c7bcca480db14546596001914226fb90b5592 · open-edge-platform/edge-microvisor-toolkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
name: "CodeQL Advanced"

on:
  push:
    branches: [3.0*,next,26.06*]
  pull_request:
    branches: [3.0*,next,26.06*]
  schedule:
    - cron: '0 4 * * 3'
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: [ubuntu-latest]
    permissions:
      # required for all workflows
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none
          - language: go
            build-mode: autobuild
          - language: python
            build-mode: none
    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5    #v4
        with:
          persist-credentials: false

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@ae9ef3a1d2e3413523c3741725c30064970cc0d4    #v3
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@ae9ef3a1d2e3413523c3741725c30064970cc0d4    #v3
        with:
          category: "/language:${{matrix.language}}"

      - name: Generate Security Report
        uses: rsdmike/github-security-report-action@a149b24539044c92786ec39af8ba38c93496495d    #v3.0.4
        with:
          template: report
          token: ${{ secrets.SECURITY_TOKEN }}

      - name: Rename Report by Code Matrix
        run: |
          mv ./report.pdf ./report-${{ matrix.language }}.pdf

      - name: GitHub Upload Release Artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02    #v4
        with:
          name: report-${{ matrix.language }}
          path: |
           ./report-${{ matrix.language }}.pdf