From f15347cf655ec1d5af1eebc5c4b3719a311d8a61 Mon Sep 17 00:00:00 2001 From: Dan Chao Date: Wed, 29 Apr 2026 15:53:21 -0700 Subject: [PATCH] Run CodeQL on GitHub Actions --- .github/PklProject | 4 ++-- .github/PklProject.deps.json | 16 ++++++++-------- .github/dependabot.yml | 2 ++ .github/workflows/__lockfile__.yml | 4 ++++ .github/workflows/codeql.yml | 28 ++++++++++++++++++++++++++++ .gitignore | 2 ++ 6 files changed, 46 insertions(+), 10 deletions(-) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/PklProject b/.github/PklProject index bddb53c..54c401c 100644 --- a/.github/PklProject +++ b/.github/PklProject @@ -18,9 +18,9 @@ amends "pkl:Project" dependencies { ["pkl.impl.ghactions"] { - uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.5.0" + uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.7.1" } ["com.github.actions"] { - uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.3.0" + uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.6.0" } } diff --git a/.github/PklProject.deps.json b/.github/PklProject.deps.json index 457d181..bda19c5 100644 --- a/.github/PklProject.deps.json +++ b/.github/PklProject.deps.json @@ -3,16 +3,16 @@ "resolvedDependencies": { "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1": { "type": "remote", - "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.3.1", + "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.6.0", "checksums": { - "sha256": "fd515da685ea126678c3ec684e84a4f992d43481cc1d75cb866cd55775f675f9" + "sha256": "10e27d63df4a4520d8a9375962406ca5ffe74f396bd3cb1c19b1f8358505010a" } }, "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1": { "type": "remote", - "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.5.0", + "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.7.1", "checksums": { - "sha256": "2c1e0d9efcd65b3c3207bf535c325ebc0ec2ab169187b324c4bb70821cac0e51" + "sha256": "93cdf1bdd3e7f6c1c83f49791b8c02fbee9ac2e721d299cad6c15d142fd5d762" } }, "package://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1": { @@ -24,16 +24,16 @@ }, "package://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1": { "type": "remote", - "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1.0.3", + "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1.1.3", "checksums": { - "sha256": "d368900942efb88ed51a98f9614748b06c74ba43423f045fcd6dedb5dbdc0bea" + "sha256": "521feb6f5ff12075ebad0758799fe7ec2675d231a0e0f5456694c8d4822a8171" } }, "package://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1": { "type": "remote", - "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1.0.0", + "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1.0.4", "checksums": { - "sha256": "02ef6f25bfca5b1d095db73ea15de79d2d2c6832ebcab61e6aba90554382abcb" + "sha256": "c7391119f946d7761d0ca0cc358ed8fe2bdfc691411087ccac89637bd96fec4a" } } } diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 73242db..acca6fc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,8 @@ version: 2 updates: - package-ecosystem: github-actions + cooldown: + default-days: 7 directory: / ignore: - dependency-name: '*' diff --git a/.github/workflows/__lockfile__.yml b/.github/workflows/__lockfile__.yml index 1246c08..8a438d0 100644 --- a/.github/workflows/__lockfile__.yml +++ b/.github/workflows/__lockfile__.yml @@ -24,3 +24,7 @@ jobs: uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 - name: dawidd6/action-download-artifact@v11 uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11 + - name: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4 + - name: github/codeql-action/init@v4 + uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..1553d83 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,28 @@ +# Generated from Workflow.pkl. DO NOT EDIT. +'on': + pull_request: + branches: + - main + push: + branches: + - main + schedule: + - cron: 29 17 * * 4 +jobs: + analyze-actions: + name: Analyze (actions) + permissions: + security-events: write + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4 + with: + languages: actions + build-mode: none + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4 + with: + category: /language:actions diff --git a/.gitignore b/.gitignore index cb35c6a..cbaa081 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,5 @@ MODULE.bazel.lock # Pkl LSP .pkl-lsp/ +# VSCode +.vscode/ \ No newline at end of file