Skip to content

Commit 53ccb8f

Browse files
committed
Update CodeQL workflow name and triggers
## Summary - Enable CodeQL static analysis to scan Go code for security vulnerabilities and coding errors - Runs on pushes and PRs to `main`, plus a weekly scheduled scan - Addresses the https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast (currently 0/10) Part of the work on Kuadrant/kuadrant-operator#2055 Signed-off-by: averevki <sandyverevkin@gmail.com>
1 parent 72111de commit 53ccb8f

1 file changed

Lines changed: 49 additions & 0 deletions

File tree

.github/workflows/codeql.yml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# generated from the template https://github.com/actions/starter-workflows/blob/1035244887e26fbbd4f1017d919fb5995cc521c4/code-scanning/codeql.yml
2+
name: CodeQL
3+
4+
on:
5+
push:
6+
branches: ["main"]
7+
pull_request:
8+
branches: ["main"]
9+
merge_group:
10+
types: ["checks_requested"]
11+
schedule:
12+
- cron: '40 3 * * 6' # random schedule to avoid hitting the rate limit of the CodeQL and GitHub Actions API
13+
workflow_dispatch:
14+
15+
jobs:
16+
analyze:
17+
name: Analyze (${{ matrix.language }})
18+
runs-on: ubuntu-latest
19+
permissions:
20+
security-events: write
21+
packages: read
22+
actions: read
23+
contents: read
24+
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
include:
29+
- language: actions
30+
build-mode: none
31+
- language: go
32+
build-mode: autobuild
33+
34+
steps:
35+
- name: Checkout repository
36+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
37+
with:
38+
persist-credentials: false
39+
40+
- name: Initialize CodeQL
41+
uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # ratchet:github/codeql-action/init@v4
42+
with:
43+
languages: ${{ matrix.language }}
44+
build-mode: ${{ matrix.build-mode }}
45+
46+
- name: Perform CodeQL Analysis
47+
uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # ratchet:github/codeql-action/analyze@v4
48+
with:
49+
category: "/language:${{matrix.language}}"

0 commit comments

Comments
 (0)