Skip to content

*: new workflow org-codeql #11

*: new workflow org-codeql

*: new workflow org-codeql #11

Workflow file for this run

name: CodeQL
on:
workflow_dispatch:
push:
branches: [main, master, staging, development, devel, dev, prod]
pull_request:
types: [opened, synchronize, reopened, ready_for_review]
branches: [main, master, staging, development, devel, dev]
merge_group:
permissions:
contents: read
issues: read
pull-requests: read
jobs:
codeql:
name: codeql
runs-on: ubuntu-latest
strategy:
fail-fast: false
steps:
- name: Get changed files
id: changed-files
uses: tj-actions/changed-files@ae82ed4ae04587b665efad2f206578aa6f0e8539 # v42.0.0
with:
separator: '\0'
files: |
**/*.{cpp,c++,hpp,hh,h++,hxx,c,cc,h}
**/*.{sln,csproj,cs,cshtml,xaml}
**/*.go
**/*.java
**/*.kt
**/*.{js,jsx,mjs,es,es6,htm,html,xhtm,xhtml,vue,hbs,ejs,njk,json,yaml,yml,raml,xml}
**/*.py
**/*.{rb,erb,gemspec}
**/Gemfile
**/*.swift
**/*.{ts,tsx,mts,cts}
- name: Store configurations
id: cfg
env:
DEBUG: ${{ runner.debug && 'true' || 'false'}}
FILES: ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
script: |
const { exists } = await import('fs/promises');
console.log(${{ toJSON(github) }});
const { default: getConfig } = await import('${{ github.workspace }}/src/getConfig.js');
const { default: getProperties } = await import('${{ github.action_path }}/src/getProperties.js');
var debug = process.env.DEBUG == 'true';
if (debug) console.log("Initializing CodeQL Action");
const query = `
query($owner: String!, $name: String!) {
repository(owner: $owner, name: $name) {
isPrivate
}
}
`;
const variables = {
owner: context.repo.owner,
name: context.repo.repo,
};
const result = await github.graphql(query, variables);
const isPrivate = result.repository.isPrivate;
const isDraft = context.payload.pull_request?.draft;
const isBot = context.actor.endsWith('[bot]');
const isEmptyFiles = process.env.FILES.trim() === '';
const config = await getConfig({owner: context.repo.owner, repo: context.repo.repo, path: '.github/codeql.json', debug, github});
const properties = await getProperties({owner: context.repo.owner, repo: context.repo.repo, debug, github});
const options = Object.assign({
codeql_enabled: !isDraft && !isBot && !isPrivate && !isEmptyFiles,
codeql_config_file: await exists('.github/codeql/codeql-config.yml') ?
'.github/codeql/codeql-config.yml' :
await exists('${{ github.action_path }}/.github/codeql/codeql-config.yml') ?
'${{ github.action_path }}/.github/codeql/codeql-config.yml' :
undefined,
}, config, properties);
return options;
- if: ${{ steps.cfg.outputs.result.codeql_enabled == 'true' }}
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- if: ${{ steps.cfg.outputs.result.codeql_enabled == 'true' }}
name: Initialize CodeQL
uses: github/codeql-action/init@0b21cf2492b6b02c465a3e5d7c473717ad7721ba # v3.23.1
with:
config-file: ${{ steps.cfg.outputs.result.codeql_config_file }}
- if: ${{ steps.cfg.outputs.result.codeql_enabled == 'true' }}
name: Autobuild
uses: github/codeql-action/autobuild@0b21cf2492b6b02c465a3e5d7c473717ad7721ba # v3.23.1
- if: ${{ steps.cfg.outputs.result.codeql_enabled == 'true' }}
name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@0b21cf2492b6b02c465a3e5d7c473717ad7721ba # v3.23.1