Merge pull request #350 from trinadhthatakula/refactor/testable-privi… #474
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [ "master", "dev" ] | |
| pull_request: | |
| branches: [ "master", "dev" ] | |
| schedule: | |
| - cron: '27 3 * * 1' # weekly, Monday 03:27 UTC | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| actions: read | |
| strategy: | |
| # One language failing to build a database must not hide the other's findings. | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: java-kotlin | |
| build-mode: none | |
| # web/ is a brand-new JavaScript/TypeScript surface — the repo's first — | |
| # and until this entry existed it had no security analysis at all. | |
| # | |
| # `paths` is scoped to web because that is where every tracked .ts/.mjs | |
| # file lives; an unscoped JS analysis would spend its time on whatever | |
| # tooling JSON happens to be checked in. Note the coverage limit this | |
| # buys and does not remove: the CodeQL JS extractor does not understand | |
| # .astro, so components are analysed only through the .ts they import. | |
| # | |
| # `paths`/`paths-ignore` apply to interpreted languages only, which is | |
| # exactly why the java-kotlin entry above carries no config — there it | |
| # would be silently ignored rather than rejected. | |
| - language: javascript-typescript | |
| build-mode: none | |
| config: | | |
| paths: | |
| - web | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4.37.4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| config: ${{ matrix.config }} | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4.37.4 | |
| with: | |
| category: "/language:${{ matrix.language }}" |