mirror of
https://github.com/github/codeql-action.git
synced 2025-12-15 20:09:17 +08:00
Compare commits
3 Commits
henrymerce
...
henrymerce
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
cd7d05db5b | ||
|
|
1df1cede6b | ||
|
|
1c1db4a6f1 |
70
.github/workflows/codeql.yml
vendored
70
.github/workflows/codeql.yml
vendored
@@ -2,80 +2,17 @@ name: "CodeQL action"
|
|||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches: [main, releases/v*]
|
|
||||||
pull_request:
|
|
||||||
branches: [main, releases/v*]
|
|
||||||
# Run checks on reopened draft PRs to support triggering PR checks on draft PRs that were opened
|
|
||||||
# by other workflows.
|
|
||||||
types: [opened, synchronize, reopened, ready_for_review]
|
|
||||||
schedule:
|
|
||||||
# Weekly on Sunday.
|
|
||||||
- cron: '30 1 * * 0'
|
|
||||||
workflow_dispatch:
|
|
||||||
|
|
||||||
env:
|
env:
|
||||||
CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
|
CODEQL_ACTION_TESTING_ENVIRONMENT: codeql-action-pr-checks
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
# Identify the CodeQL tool versions to use in the analysis job.
|
|
||||||
check-codeql-versions:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
outputs:
|
|
||||||
versions: ${{ steps.compare.outputs.versions }}
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
security-events: write
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- name: Init with default CodeQL bundle from the VM image
|
|
||||||
id: init-default
|
|
||||||
uses: ./init
|
|
||||||
with:
|
|
||||||
languages: javascript
|
|
||||||
- name: Remove empty database
|
|
||||||
# allows us to run init a second time
|
|
||||||
run: |
|
|
||||||
rm -rf "$RUNNER_TEMP/codeql_databases"
|
|
||||||
- name: Init with latest CodeQL bundle
|
|
||||||
id: init-latest
|
|
||||||
uses: ./init
|
|
||||||
with:
|
|
||||||
tools: latest
|
|
||||||
languages: javascript
|
|
||||||
- name: Compare default and latest CodeQL bundle versions
|
|
||||||
id: compare
|
|
||||||
env:
|
|
||||||
CODEQL_DEFAULT: ${{ steps.init-default.outputs.codeql-path }}
|
|
||||||
CODEQL_LATEST: ${{ steps.init-latest.outputs.codeql-path }}
|
|
||||||
run: |
|
|
||||||
CODEQL_VERSION_DEFAULT="$("$CODEQL_DEFAULT" version --format terse)"
|
|
||||||
CODEQL_VERSION_LATEST="$("$CODEQL_LATEST" version --format terse)"
|
|
||||||
echo "Default CodeQL bundle version is $CODEQL_VERSION_DEFAULT"
|
|
||||||
echo "Latest CodeQL bundle version is $CODEQL_VERSION_LATEST"
|
|
||||||
|
|
||||||
# If we're running on a pull request, run with both bundles, even if `tools: latest` would
|
|
||||||
# be the same as `tools: null`. This allows us to make the job for each of the bundles a
|
|
||||||
# required status check.
|
|
||||||
#
|
|
||||||
# If we're running on push or schedule, then we can skip running with `tools: latest` when it would be
|
|
||||||
# the same as running with `tools: null`.
|
|
||||||
if [[ "$GITHUB_EVENT_NAME" != "pull_request" && "$CODEQL_VERSION_DEFAULT" == "$CODEQL_VERSION_LATEST" ]]; then
|
|
||||||
VERSIONS_JSON='[null]'
|
|
||||||
else
|
|
||||||
VERSIONS_JSON='[null, "latest"]'
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Output a JSON-encoded list with the distinct versions to test against.
|
|
||||||
echo "Suggested matrix config for analysis job: $VERSIONS_JSON"
|
|
||||||
echo "versions=${VERSIONS_JSON}" >> $GITHUB_OUTPUT
|
|
||||||
|
|
||||||
build:
|
build:
|
||||||
needs: [check-codeql-versions]
|
|
||||||
strategy:
|
strategy:
|
||||||
matrix:
|
matrix:
|
||||||
os: [ubuntu-20.04,ubuntu-22.04,windows-2019,windows-2022,macos-11,macos-12,macos-13]
|
include:
|
||||||
tools: ${{ fromJson(needs.check-codeql-versions.outputs.versions) }}
|
- os: windows-2022
|
||||||
|
tools: https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/codeql-bundle-20240112/codeql-bundle-win64.tar.gz
|
||||||
runs-on: ${{ matrix.os }}
|
runs-on: ${{ matrix.os }}
|
||||||
|
|
||||||
permissions:
|
permissions:
|
||||||
@@ -88,6 +25,7 @@ jobs:
|
|||||||
uses: ./init
|
uses: ./init
|
||||||
id: init
|
id: init
|
||||||
with:
|
with:
|
||||||
|
debug: true
|
||||||
languages: javascript
|
languages: javascript
|
||||||
config-file: ./.github/codeql/codeql-config.yml
|
config-file: ./.github/codeql/codeql-config.yml
|
||||||
tools: ${{ matrix.tools }}
|
tools: ${{ matrix.tools }}
|
||||||
|
|||||||
Reference in New Issue
Block a user