Enable CodeQL scan for GitHub Actions #1821
Conversation
Update the CI configuration to run CodeQL on GitHub Actions in addition to JavaScript. This uses a matrix as suggested in the description of the "languages" input for the `github/codeql-action/init` action.
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
.github/workflows/checks.yml
Outdated
| with: | ||
| config-file: ./.github/codeql.yml | ||
| languages: javascript | ||
| # config-file: ./.github/codeql.yml |
There was a problem hiding this comment.
This job currently fails if this line is enabled because the configuration is not valid if matrix.what == 'actions', but we want the configuration for matrix.what == 'javascript'...
There was a problem hiding this comment.
The reason for this is this line:
Line 6 in 7b57255
which it complained about here.
This has been reported at github/codeql-action#2658
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as outdated.
This comment was marked as outdated.
Relates to #134, #1114, #1751
Summary
Update the CI configuration to run CodeQL on GitHub Actions in addition to JavaScript. This uses a matrix as suggested in the description of the "languages" input for the
github/codeql-action/initaction.Based on https://github.blog/changelog/2024-12-17-find-and-fix-actions-workflows-vulnerabilities-with-codeql-public-preview/