|
19 | 19 |
|
20 | 20 | jobs: |
21 | 21 | analyze: |
22 | | -name:Analyze |
| 22 | +name:Analyze (${{ matrix.language }}) |
23 | 23 | # Runner size impacts CodeQL analysis time. To learn more, please see: |
24 | 24 | # - https://gh.io/recommended-hardware-resources-for-running-codeql |
25 | 25 | # - https://gh.io/supported-runners-and-hardware-resources |
26 | | -# - https://gh.io/using-larger-runners |
27 | | -# Consider using larger runners for possible analysis time improvements. |
| 26 | +# - https://gh.io/using-larger-runners (GitHub.com only) |
| 27 | +# Consider using larger runnersor machines with greater resourcesfor possible analysis time improvements. |
28 | 28 | runs-on:${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} |
29 | | -timeout-minutes:${{ (matrix.language == 'swift' && 120) || 360 }} |
30 | 29 | permissions: |
31 | | -actions:read |
32 | | -contents:read |
33 | 30 | security-events:write |
34 | 31 |
|
35 | 32 | strategy: |
36 | 33 | fail-fast:false |
37 | 34 | matrix: |
38 | | -language:[ 'python' ] |
39 | | -# CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ] |
40 | | -# Use only 'java-kotlin' to analyze code written in Java, Kotlin or both |
41 | | -# Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both |
42 | | -# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support |
43 | | - |
| 35 | +include: |
| 36 | + -language:actions |
| 37 | +build-mode:none |
| 38 | + -language:python |
| 39 | +build-mode:none |
| 40 | +# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' |
| 41 | +# Use `c-cpp` to analyze code written in C, C++ or both |
| 42 | +# Use 'java-kotlin' to analyze code written in Java, Kotlin or both |
| 43 | +# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both |
| 44 | +# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, |
| 45 | +# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. |
| 46 | +# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how |
| 47 | +# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages |
44 | 48 | steps: |
45 | 49 | -name:Checkout repository |
46 | 50 | uses:actions/checkout@v4 |
47 | 51 |
|
| 52 | +# Add any setup steps before running the `github/codeql-action/init` action. |
| 53 | +# This includes steps like installing compilers or runtimes (`actions/setup-node` |
| 54 | +# or others). This is typically only required for manual builds. |
| 55 | +# - name: Setup runtime (example) |
| 56 | +# uses: actions/setup-example@v1 |
| 57 | + |
48 | 58 | # Initializes the CodeQL tools for scanning. |
49 | 59 | -name:Initialize CodeQL |
50 | 60 | uses:github/codeql-action/init@v3 |
51 | 61 | with: |
52 | 62 | languages:${{ matrix.language }} |
53 | | -setup-python-dependencies:false |
| 63 | +build-mode:${{ matrix.build-mode }} |
54 | 64 | # If you wish to specify custom queries, you can do so here or in a config file. |
55 | 65 | # By default, queries listed here will override any specified in a config file. |
56 | 66 | # Prefix the list here with "+" to use these queries and those in the config file. |
57 | 67 |
|
58 | 68 | # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs |
59 | 69 | # queries: security-extended,security-and-quality |
60 | 70 |
|
61 | | - |
62 | | -# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift). |
63 | | -# If this step fails, then you should remove it and run the build manually (see below) |
64 | | - -name:Autobuild |
65 | | -uses:github/codeql-action/autobuild@v3 |
66 | | - |
| 71 | +# If the analyze step fails for one of the languages you are analyzing with |
| 72 | +# "We were unable to automatically build your code", modify the matrix above |
| 73 | +# to set the build mode to "manual" for that language. Then modify this step |
| 74 | +# to build your code. |
67 | 75 | # ℹ️ Command-line programs to run using the OS shell. |
68 | 76 | # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun |
69 | | - |
70 | | -# If the Autobuild fails above, remove it and uncomment the following three lines. |
71 | | -# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. |
72 | | - |
73 | | -# - run: | |
74 | | -# echo "Run, Build Application using script" |
75 | | -# ./location_of_script_within_repo/buildscript.sh |
| 77 | + -if:matrix.build-mode == 'manual' |
| 78 | +shell:bash |
| 79 | +run:| |
| 80 | + echo 'If you are using a "manual" build mode for one or more of the' \ |
| 81 | + 'languages you are analyzing, replace this with the commands to build' \ |
| 82 | + 'your code, for example:' |
| 83 | + echo ' make bootstrap' |
| 84 | + echo ' make release' |
| 85 | + exit 1 |
76 | 86 |
|
77 | 87 | -name:Perform CodeQL Analysis |
78 | 88 | uses:github/codeql-action/analyze@v3 |
|