FilesExpand file tree

 master

/

codeql.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

62 lines (53 loc) · 1.68 KB

 master

/

codeql.yml

Copy path

Top

File metadata and controls

• Code
• Blame

62 lines (53 loc) · 1.68 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

name: Code Scanning

on:

push:

branches: [trunk]

pull_request:

branches: [trunk]

paths-ignore:

- '**/*.md'

schedule:

- cron: "0 0 * * 0"

permissions:

actions: read # for github/codeql-action/init to get workflow details

contents: read # for actions/checkout to fetch code

security-events: write # for github/codeql-action/analyze to upload SARIF results

jobs:

CodeQL-Build:

runs-on: ubuntu-latest

strategy:

fail-fast: false

matrix:

language: ['go', 'actions']

steps:

- name: Check out code

uses: actions/checkout@v6

- name: Setup Go

if: matrix.language == 'go'

uses: actions/setup-go@v6

with:

go-version-file: "go.mod"

- name: Initialize CodeQL

uses: github/codeql-action/init@v4

with:

languages: ${{ matrix.language }}

queries: security-and-quality

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@v4

with:

category: "/language:${{ matrix.language }}"

upload: false

output: sarif-results

- name: Filter SARIF for third-party code

if: matrix.language == 'go'

uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1.0.1.1

with:

patterns: |

-third-party/**

input: sarif-results/${{ matrix.language }}.sarif

output: sarif-results/${{ matrix.language }}.sarif

- name: Upload filtered SARIF

uses: github/codeql-action/upload-sarif@v4

with:

sarif_file: sarif-results/${{ matrix.language }}.sarif

category: "/language:${{ matrix.language }}"