ci: migrate CodeQL from default to advanced setup (#13) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CodeQL advanced setup. | |
| # | |
| # Replaces the repository's CodeQL *default* setup, which only analyses a pull | |
| # request when it touches files relevant to the configured languages. A PR that | |
| # changes only docs or dependency manifests produced no analysis at all, while | |
| # `master` still carried one per language — so the `code_scanning` branch rule | |
| # could not diff the two sides and reported "configurations not found". | |
| # | |
| # Running here, with no path filter, guarantees both configurations exist on | |
| # every pull request. The categories below must keep matching the ones recorded | |
| # on `master` (`/language:actions`, `/language:rust`) for that diff to work. | |
| name: CodeQL | |
| on: | |
| push: | |
| branches: [ "master" ] | |
| pull_request: | |
| branches: [ "master" ] | |
| schedule: | |
| # Weekly, to catch newly published queries against unchanged code. | |
| - cron: '27 4 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write # upload the SARIF results | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Keep in sync with the languages the previous default setup covered. | |
| language: [ actions, rust ] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # Neither language needs a compiled build for CodeQL to extract it. | |
| build-mode: none | |
| queries: security-extended | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" |