FilesExpand file tree

main

/

codeql.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

87 lines (73 loc) · 2.29 KB

main

/

codeql.yml

Copy path

Top

File metadata and controls

• Code
• Blame

87 lines (73 loc) · 2.29 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

name: "CodeQL"

on:

push:

branches: [ "main" ]

pull_request:

branches: [ "main" ]

schedule:

- cron: "46 2 * * 5"

# Allow job to be triggered manually.

workflow_dispatch:

# Cancel in-progress jobs when pushing to the same branch.

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

cancel-in-progress: true

jobs:

analyze:

name: "Analyze Python code"

runs-on: ubuntu-latest

permissions:

actions: read

contents: read

security-events: write

strategy:

fail-fast: false

matrix:

language: [ python ]

python-version: ['3.13']

steps:

- name: Checkout

uses: actions/checkout@v7

- name: Set up Python

uses: actions/setup-python@v7

with:

python-version: ${{ matrix.python-version }}

- name: Set up uv

uses: astral-sh/setup-uv@v7

with:

cache-dependency-glob: |

setup.py

cache-suffix: ${{ matrix.python-version }}

enable-cache: true

version: "latest"

- name: Initialize CodeQL

uses: github/codeql-action/init@v4.37.9

with:

languages: ${{ matrix.language }}

config-file: ./.github/codeql.yml

queries: +security-and-quality

# run an 'alert-suppression' query

packs: "codeql/${{ matrix.language }}-queries:AlertSuppression.ql"

#- name: Autobuild

# uses: github/codeql-action/autobuild@v2

- name: Install project

run: |

uv pip install --system '.[test]'

- name: Perform CodeQL Analysis

id: analyze

uses: github/codeql-action/analyze@v4.37.9

with:

category: "/language:${{matrix.language}}"

# define the output folder for SARIF files

output: sarif-results

# Unlock inline mechanism to suppress CodeQL warnings.

# https://github.com/github/codeql/issues/11427#issuecomment-1721059096

- name: Dismiss alerts

# if: github.ref == 'refs/heads/main'

uses: advanced-security/dismiss-alerts@v2

with:

# specify a 'sarif-id' and 'sarif-file'

sarif-id: ${{ steps.analyze.outputs.sarif-id }}

sarif-file: sarif-results/${{ matrix.language }}.sarif

env:

GITHUB_TOKEN: ${{ github.token }}