FilesExpand file tree

main

/

code-scanning.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

98 lines (89 loc) · 3.49 KB

main

/

code-scanning.yml

Copy path

Top

File metadata and controls

• Code
• Blame

98 lines (89 loc) · 3.49 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

name: "CodeQL"

run-name: ${{ github.event.inputs.code_scanning_run_name }}

on: [push, pull_request, workflow_dispatch]

concurrency:

group: ${{ github.workflow }}-${{ github.ref }}

cancel-in-progress: true

env:

CODE_SCANNING_REF: ${{ github.event.inputs.code_scanning_ref }}

CODE_SCANNING_BASE_BRANCH: ${{ github.event.inputs.code_scanning_base_branch }}

CODE_SCANNING_IS_ANALYZING_DEFAULT_BRANCH: ${{ github.event.inputs.code_scanning_is_analyzing_default_branch }}

jobs:

analyze:

name: Analyze (${{ matrix.language }})

# Only run on the main repository, not on forks

if: github.repository == 'github/github-mcp-server'

runs-on: ${{ fromJSON(matrix.runner) }}

permissions:

actions: read

contents: read

packages: read

security-events: write

continue-on-error: false

strategy:

fail-fast: false

matrix:

include:

- language: actions

category: /language:actions

build-mode: none

runner: '["ubuntu-22.04"]'

- language: go

category: /language:go

build-mode: autobuild

runner: '["ubuntu-22.04"]'

- language: javascript

category: /language:javascript

build-mode: none

runner: '["ubuntu-22.04"]'

steps:

- name: Checkout repository

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

- name: Initialize CodeQL

uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

with:

languages: ${{ matrix.language }}

build-mode: ${{ matrix.build-mode }}

dependency-caching: ${{ runner.environment == 'github-hosted' }}

queries: "" # Default query suite

packs: github/ccr-${{ matrix.language }}-queries

config: |

paths-ignore:

- third-party

- third-party-licenses.*.md

default-setup:

org:

model-packs: [ ${{ github.event.inputs.code_scanning_codeql_packs }} ]

threat-models: [ ]

- name: Setup proxy for registries

id: proxy

uses: github/codeql-action/start-proxy@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

with:

registries_credentials: ${{ secrets.GITHUB_REGISTRIES_PROXY }}

language: ${{ matrix.language }}

- name: Setup Go

uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7

if: matrix.language == 'go'

with:

go-version-file: "go.mod"

cache: false

- name: Set up Node.js (for JavaScript CodeQL)

if: matrix.language == 'javascript'

uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7

with:

node-version-file: ui/package.json

cache: "npm"

cache-dependency-path: ui/package-lock.json

- name: Build UI

if: matrix.language == 'go'

uses: ./.github/actions/build-ui

- name: Autobuild

uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2

env:

CODEQL_PROXY_HOST: ${{ steps.proxy.outputs.proxy_host }}

CODEQL_PROXY_PORT: ${{ steps.proxy.outputs.proxy_port }}

CODEQL_PROXY_CA_CERTIFICATE: ${{ steps.proxy.outputs.proxy_ca_certificate }}

with:

category: ${{ matrix.category }}