WriteableFileProviders/.github/workflows/codeql.yml at main · serionist/WriteableFileProviders · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
# CodeQL code scanning, on every pull request, every push to main and once a week, so new queries also reach code that
# has not changed. Results go to the repository's Security tab and annotate the PR.
#
# C# runs in build mode "none": CodeQL restores the packages and extracts the sources without building them. GitHub's
# docs rate it less accurate than a build only for code generated during the build or dependencies it cannot guess; this
# repo has no source generators, one package source (nuget.config) and one target framework, so neither applies. The
# workflows themselves (language "actions") are scanned too, for script injection and over-broad permissions.
#
# This is CodeQL's advanced setup: the repository's default setup must stay off, or the two uploads conflict.
name: CodeQL

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "23 4 * * 1"

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      # Uploads the results to code scanning.
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: [csharp, actions]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # The SDK global.json names, for CodeQL's package restore.
      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        if: matrix.language == 'csharp'
        with:
          global-json-file: global.json
      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          languages: ${{ matrix.language }}
          build-mode: none
          queries: security-extended
      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
        with:
          category: /language:${{ matrix.language }}