Skip to content

Commit

Permalink
Create codeql github action (#17107)
Browse files Browse the repository at this point in the history
Summary of the issue:
CodeQL scanning was set up via the UI.
We want to configure this via YML, so we can set the branches that it runs on more easily.

Description of development approach
Uses default template to set up python scanning on master, beta,rc
  • Loading branch information
seanbudd authored Sep 3, 2024
1 parent 52cefb8 commit 1315df7
Showing 1 changed file with 69 additions and 0 deletions.
69 changes: 69 additions & 0 deletions .github/workflows/codeql.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
name: "CodeQL code scanning"

on:
push:
branches: [ "master", "beta", "rc" ]
pull_request:
branches: [ "master", "beta", "rc" ]
schedule:
# Scheduled jobs only run on the default branch.
- cron: '35 22 * * 3'

jobs:
analyze:
name: Analyze (${{ matrix.language }})
runs-on: windows-latest
permissions:
# required for all workflows
security-events: write

# required to fetch internal or private CodeQL packs
packages: read

# only required for workflows in private repositories
actions: read
contents: read

strategy:
fail-fast: false
matrix:
include:
- language: python
build-mode: none
steps:
- name: Checkout repository
uses: actions/checkout@v4

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.

# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
# queries: security-extended,security-and-quality

# If the analyze step fails for one of the languages you are analyzing with
# "We were unable to automatically build your code", modify the matrix above
# to set the build mode to "manual" for that language. Then modify this step
# to build your code.
# ℹ️ Command-line programs to run using the OS shell.
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
- if: matrix.build-mode == 'manual'
shell: bash
run: |
echo 'If you are using a "manual" build mode for one or more of the' \
'languages you are analyzing, replace this with the commands to build' \
'your code, for example:'
echo ' make bootstrap'
echo ' make release'
exit 1
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: "/language:${{matrix.language}}"

0 comments on commit 1315df7

Please sign in to comment.