actions
/
toolkit
mirror of https://github.com/actions/toolkit
1
0
Fork 0
Code
toolkit/.github/workflows/codeql.yml

38 lines
855 B
YAML
Raw Normal View History

Add CodeQL Analysis workflow (#434) * Add CodeQL Analysis workflow * Rename .github/workflows/workflows/codeql.yml to .github/workflows/codeql.yml * Remove autobuilder * Add back autobuilder * Disable c# analysis
2020-05-06 16:58:36 +00:00
name: "Code Scanning - Action"
on:
push:
Only run codeql on main branch pushes (#826)
2021-06-01 14:11:52 +00:00
branches:
- main
Add on: pull_request trigger to CodeQL workflow (#689) From February 2021, in order to provide feedback on pull requests, Code Scanning workflows must be configured with both `push` and `pull_request` triggers. This is because Code Scanning compares the results from a pull request against the results for the base branch to tell you only what has changed between the two. Early in the beta period we supported displaying results on pull requests for workflows with only `push` triggers, but have discontinued support as this proved to be less robust. See https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#scanning-pull-requests for more information on how best to configure your Code Scanning workflows.
2021-01-15 11:22:00 +00:00
pull_request:
Add CodeQL Analysis workflow (#434) * Add CodeQL Analysis workflow * Rename .github/workflows/workflows/codeql.yml to .github/workflows/codeql.yml * Remove autobuilder * Add back autobuilder * Disable c# analysis
2020-05-06 16:58:36 +00:00
schedule:
- cron: '0 0 * * 0'
jobs:
CodeQL-Build:
strategy:
fail-fast: false
# CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
runs-on: ubuntu-latest
steps:
- name: Checkout repository
Update workflows to use v4 actions (#1652) * Update releases.yml to use v4 actions * Bump all workflows
2024-02-01 17:50:47 +00:00
uses: actions/checkout@v4
Add CodeQL Analysis workflow (#434) * Add CodeQL Analysis workflow * Rename .github/workflows/workflows/codeql.yml to .github/workflows/codeql.yml * Remove autobuilder * Add back autobuilder * Disable c# analysis
2020-05-06 16:58:36 +00:00
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
Upgrade codeql actions to v2 Currently we're using v1, and there have been some important changes since then. In particular, the latest version, v2.14.6, contains an important security patch: > The CodeQL CLI no longer supports the `SEMMLE_JAVA_ARGS` environment variable. All previous versions of the CodeQL CLI perform command substitution on the `SEMMLE_JAVA_ARGS` value (for example, replacing `'$(echo foo)'` with `'foo'`) when starting a new Java virtual machine, which, depending on the execution environment, may have security implications. Users are advised to check their environments for possible `SEMMLE_JAVA_ARGS` misuse. See the [codeql-cli-binaries release notes](https://github.com/github/codeql-cli-binaries/releases/tag/v2.14.4) for full details.
2023-09-27 19:18:59 +00:00
uses: github/codeql-action/init@v2
Add CodeQL Analysis workflow (#434) * Add CodeQL Analysis workflow * Rename .github/workflows/workflows/codeql.yml to .github/workflows/codeql.yml * Remove autobuilder * Add back autobuilder * Disable c# analysis
2020-05-06 16:58:36 +00:00
with:
languages: javascript
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
Upgrade codeql actions to v2 Currently we're using v1, and there have been some important changes since then. In particular, the latest version, v2.14.6, contains an important security patch: > The CodeQL CLI no longer supports the `SEMMLE_JAVA_ARGS` environment variable. All previous versions of the CodeQL CLI perform command substitution on the `SEMMLE_JAVA_ARGS` value (for example, replacing `'$(echo foo)'` with `'foo'`) when starting a new Java virtual machine, which, depending on the execution environment, may have security implications. Users are advised to check their environments for possible `SEMMLE_JAVA_ARGS` misuse. See the [codeql-cli-binaries release notes](https://github.com/github/codeql-cli-binaries/releases/tag/v2.14.4) for full details.
2023-09-27 19:18:59 +00:00
uses: github/codeql-action/autobuild@v2
Add CodeQL Analysis workflow (#434) * Add CodeQL Analysis workflow * Rename .github/workflows/workflows/codeql.yml to .github/workflows/codeql.yml * Remove autobuilder * Add back autobuilder * Disable c# analysis
2020-05-06 16:58:36 +00:00
- name: Perform CodeQL Analysis
Upgrade codeql actions to v2 Currently we're using v1, and there have been some important changes since then. In particular, the latest version, v2.14.6, contains an important security patch: > The CodeQL CLI no longer supports the `SEMMLE_JAVA_ARGS` environment variable. All previous versions of the CodeQL CLI perform command substitution on the `SEMMLE_JAVA_ARGS` value (for example, replacing `'$(echo foo)'` with `'foo'`) when starting a new Java virtual machine, which, depending on the execution environment, may have security implications. Users are advised to check their environments for possible `SEMMLE_JAVA_ARGS` misuse. See the [codeql-cli-binaries release notes](https://github.com/github/codeql-cli-binaries/releases/tag/v2.14.4) for full details.
2023-09-27 19:18:59 +00:00
uses: github/codeql-action/analyze@v2