iframe-proxy | Sunbelt Computer Software

Repository navigation

View runs

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

name: codeql

# Advanced setup, replacing the repo-settings "default setup".

# Default setup pinned every scan to a 4-vCPU GitHub-hosted runner with no

# cancel-in-progress, which put PR scans at 30-125 min and re-ran them on every

# push (PR #6183 burned six overlapping runs). None of that is configurable from

# the settings UI, so the config moves into the repo.

# Before enabling this, disable default setup or the two will both run:

# gh api -X PATCH repos/:owner/:repo/code-scanning/default-setup -f state=not-configured

# The runs-on expression is the same CI_PROVIDER escape hatch as ci.yml and must

# change together with it.

on:

# Pushes to main are infrequent (merges only), so a full scan per push is

# affordable and is what GitHub recommends pairing with the PR trigger:

# "Scanning code when someone pushes a change, and whenever a pull request is

# created, prevents developers from introducing new vulnerabilities."

push:

branches: [main]

# main only, not staging. Feature PRs land on staging and are ~90% of PR scan

# volume, and every one of them is scanned again — against the exact tree being

# promoted — when the staging->main PR opens. Scanning at the promotion

# boundary defers the signal rather than dropping it.

# Deliberately a branch cut and not an activity-type cut: dropping

# `synchronize` would have scanned each PR's first commit and never its final

# state, which is backwards, since review fixups land in later pushes.

pull_request:

branches: [main]

# `ready_for_review` is not a default activity type, so it has to be listed

# alongside the defaults it replaces. Without it, a PR opened as a draft and

# then marked ready is skipped by the job-level draft guard and never

# rescanned until the next push.

types: [opened, synchronize, reopened, ready_for_review]

paths:

- '**/*.ts'

- '**/*.tsx'

- '**/*.js'

- '**/*.jsx'

- '**/*.mjs'

- '**/*.cjs'

- '.github/workflows/**'

- '.github/actions/**'

- '.github/codeql/**'

schedule:

# Safety net behind the push trigger, and the thing that keeps the

# default-branch alert view fresh when main is quiet. Only fires once this

# file is on the default branch — schedule events ignore other branches.

# Daily rather than weekly. Pushes to main are rare, and with PR scans now

# limited to main the alert view leans on this more than it used to; a week

# is too long to leave it stale. It also reseeds the overlay-base database

# that PR runs restore from — that cache key embeds the CodeQL bundle

# version, so a bundle bump invalidates it, and an unused Actions cache is

# evicted after 7 days. One 8 vCPU default-branch scan a day is a few

# dollars a month against a PR scan that halves when the base is warm.

- cron: '17 8 * * *'

workflow_dispatch:

concurrency:

group: codeql-${{ github.ref }}

# PR runs only. Superseding is what this is for: a PR push makes the previous

# scan of that PR irrelevant, and `refs/pull/N/merge` keeps each PR in its own

# group. The push and schedule triggers both resolve to `refs/heads/main`, so a

# blanket `true` let the daily cron cancel the merge scan of the same commit --

# a 2-minute window that finally landed on 3c8a4c4 (push 08:32:58 killed by the

# 08:34:47 cron), leaving main with a red rollup for a commit that the cron had

# in fact scanned clean. Non-PR events now queue instead: one pending run is

# held per group, so the cron simply waits out the merge scan.

cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:

contents: read

jobs:

analyze:

name: analyze (${{ matrix.language }})

# Sized per language, not per workflow. The two analyses are nothing alike:

# javascript-typescript peaks at 19.5 GB (p95 over 3090 runs), so it needs

# the 8 vCPU tier's 30.4 GB and would OOM on the 4 vCPU tier's 15.2 GB; the

# actions analysis peaks at 1.3 GB and averages 22% CPU over a 39s median

# run, so 8 vCPU was 4x more machine than it ever used.

runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || 'ubuntu-latest' }}

timeout-minutes: 60

if: github.event.pull_request.draft != true

permissions:

security-events: write

contents: read

actions: read

strategy:

fail-fast: false

matrix:

# One entry covers both JS and TS — `javascript`, `typescript` and

# `javascript-typescript` all resolve to the same extractor

# (github/codeql-action src/languages/builtin.json), so the three

# entries default setup listed were one analysis, not three.

# `javascript-typescript` is the documented spelling. Python dropped:

# 7 files in the tree.

include:

- language: javascript-typescript

bs_runner: blacksmith-8vcpu-ubuntu-2404

- language: actions

bs_runner: blacksmith-4vcpu-ubuntu-2404

steps:

- name: Checkout repository

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6

with:

persist-credentials: false

- name: Initialize CodeQL

uses: github/codeql-action/init@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2

with:

languages: ${{ matrix.language }}

config-file: ./.github/codeql/codeql-config.yml

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2

env:

NODE_OPTIONS: --max-old-space-size=8192

with:

category: /language:${{ matrix.language }}

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

codeql.yml

codeql.yml

Sunbelt Computer Software

PL/B Language Development and Support

FilesExpand file tree

codeql.yml

Latest commit

History

codeql.yml

File metadata and controls