@biffo/cli 0.244.7 → 0.244.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
name: 'CodeQL'
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: [dev, staging, main]
|
|
6
|
+
pull_request:
|
|
7
|
+
branches: [dev, staging, main]
|
|
8
|
+
schedule:
|
|
9
|
+
# Weekly catch-up scan (Tuesday 05:17 UTC) for issues that land outside
|
|
10
|
+
# PR review (e.g. direct merges onto a branch).
|
|
11
|
+
- cron: '17 5 * * 2'
|
|
12
|
+
|
|
13
|
+
jobs:
|
|
14
|
+
analyze:
|
|
15
|
+
name: Analyze (${{ matrix.language }})
|
|
16
|
+
runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
|
|
17
|
+
# CodeQL code scanning requires GitHub Advanced Security (GHAS) on private
|
|
18
|
+
# repos — the analysis runs but the SARIF upload fails without it. So this
|
|
19
|
+
# is opt-in: enable GHAS on the repo, then set the repo variable
|
|
20
|
+
# ENABLE_CODE_SCANNING=true. Left dormant (not failing) otherwise.
|
|
21
|
+
# See biffo-template's codeql.yml for the full reasoning (#1214): a public
|
|
22
|
+
# repo can scan for free, so it does; a private one still needs the opt-in.
|
|
23
|
+
# Both existing plugin repos are public, so this scans them for nothing —
|
|
24
|
+
# which is exactly why their never having been scanned was worth fixing
|
|
25
|
+
# (#1224).
|
|
26
|
+
if: github.event.repository.private == false || vars.ENABLE_CODE_SCANNING == 'true'
|
|
27
|
+
timeout-minutes: 15
|
|
28
|
+
permissions:
|
|
29
|
+
# Required for CodeQL to upload SARIF results.
|
|
30
|
+
security-events: write
|
|
31
|
+
contents: read
|
|
32
|
+
actions: read
|
|
33
|
+
|
|
34
|
+
strategy:
|
|
35
|
+
fail-fast: false
|
|
36
|
+
matrix:
|
|
37
|
+
include:
|
|
38
|
+
- language: javascript-typescript
|
|
39
|
+
build-mode: none
|
|
40
|
+
- language: python
|
|
41
|
+
build-mode: none
|
|
42
|
+
|
|
43
|
+
steps:
|
|
44
|
+
- name: Checkout repository
|
|
45
|
+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
46
|
+
|
|
47
|
+
- name: Initialize CodeQL
|
|
48
|
+
uses: github/codeql-action/init@v4
|
|
49
|
+
with:
|
|
50
|
+
languages: ${{ matrix.language }}
|
|
51
|
+
build-mode: ${{ matrix.build-mode }}
|
|
52
|
+
queries: security-extended
|
|
53
|
+
|
|
54
|
+
# autobuild intentionally omitted (build-mode 'none'):
|
|
55
|
+
# - the plugin's Python (src/, tests/) has no build step CodeQL needs.
|
|
56
|
+
# - javascript-typescript is declared even though a fresh plugin ships no
|
|
57
|
+
# web/ directory: the skeleton itself carries scripts/*.mjs, and every
|
|
58
|
+
# real plugin grows web/ and web-admin/ (both existing ones have them).
|
|
59
|
+
# Declaring it only once a plugin gains a frontend would mean the scan
|
|
60
|
+
# silently covers less than it appears to — the shape #1270 records for
|
|
61
|
+
# the dependency audits.
|
|
62
|
+
- name: Perform CodeQL Analysis
|
|
63
|
+
uses: github/codeql-action/analyze@v4
|
|
64
|
+
with:
|
|
65
|
+
category: '/language:${{ matrix.language }}'
|