Lock file maintenance (#547) #171
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This is the same as the default setup as of writing. It appeared necessary to create this file | |
| # because the default CodeQL job stopped triggering on PRs after the master/main rename. | |
| # That might have been a temporary blip, so if desired, you can try updating repo settings to | |
| # switch back to the default CodeQL job and see if triggers for PRs (and if so, delete this file). | |
| name: CodeQL Advanced | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "15 21 * * 6" | |
| concurrency: | |
| # For PRs, use the ref (branch) in the concurrency group so that new pushes cancel any old runs. | |
| # For pushes to main, ideally we wouldn't set a concurrency group, but github actions doesn't | |
| # support conditional blocks of settings, so we use the SHA so the "group" is unique. | |
| group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.sha || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, | |
| # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. | |
| # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how | |
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | |
| language: ["actions", "javascript-typescript"] | |
| # Runner size impacts CodeQL analysis time. To learn more, please see: | |
| # - https://gh.io/recommended-hardware-resources-for-running-codeql | |
| # - https://gh.io/supported-runners-and-hardware-resources | |
| # - https://gh.io/using-larger-runners | |
| # Consider using larger runners or machines with greater resources for possible analysis time improvements. | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # required to update alerts | |
| security-events: write | |
| # required to fetch internal or private CodeQL packs | |
| packages: read | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| # Add any setup steps before running the `github/codeql-action/init` action. | |
| # This includes steps like installing compilers or runtimes (`actions/setup-node` | |
| # or others). This is typically only required for manual builds. | |
| # - name: Setup runtime (example) | |
| # uses: actions/setup-example@v1 | |
| # Initializes the CodeQL tools for scanning. | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@bffd034ab1518ad839a542b8a7356e13a240e076 # v3 | |
| with: | |
| languages: "${{ matrix.language }}" | |
| build-mode: none | |
| # If you wish to specify custom queries, you can do so here or in a config file. | |
| # By default, queries listed here will override any specified in a config file. | |
| # Prefix the list here with "+" to use these queries and those in the config file. | |
| # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs | |
| # queries: security-extended,security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@bffd034ab1518ad839a542b8a7356e13a240e076 # v3 | |
| with: | |
| category: "/language:${{matrix.language}}" |