-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Attempting to set a common configuration for all dependent projects has resulted in nothing but headaches. I give up; I'll maintain per-project CodeQL workflows for now. refs atc0005/todo#62
- Loading branch information
Showing
1 changed file
with
0 additions
and
68 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -9,74 +9,6 @@ on: | |
workflow_call: | ||
|
||
jobs: | ||
codeql: | ||
name: CodeQL | ||
runs-on: ubuntu-latest | ||
# Default: 360 minutes | ||
timeout-minutes: 10 | ||
container: | ||
# NOTE: CodeQL requires a Go version equal to or greater than the | ||
# version specified in the project's go.mod file. We use a container | ||
# image to provide this version of Go. | ||
image: "ghcr.io/atc0005/go-ci:go-ci-stable" | ||
|
||
permissions: | ||
actions: read | ||
contents: read | ||
security-events: write | ||
|
||
strategy: | ||
fail-fast: false | ||
matrix: | ||
language: ["go"] | ||
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] | ||
# Learn more: | ||
# https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed | ||
|
||
steps: | ||
- name: Checkout repository | ||
uses: actions/[email protected] | ||
|
||
# Mark the current working directory as a safe directory in git to | ||
# resolve "dubious ownership" complaints. | ||
# | ||
# https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables | ||
# https://confluence.atlassian.com/bbkb/git-command-returns-fatal-error-about-the-repository-being-owned-by-someone-else-1167744132.html | ||
# https://github.com/actions/runner-images/issues/6775 | ||
# https://github.com/actions/checkout/issues/766 | ||
- name: Mark the current working directory as a safe directory in git | ||
# run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | ||
run: git config --global --add safe.directory "${PWD}" | ||
|
||
# Initializes the CodeQL tools for scanning. | ||
- name: Initialize CodeQL | ||
uses: github/codeql-action/[email protected] | ||
with: | ||
languages: ${{ matrix.language }} | ||
# If you wish to specify custom queries, you can do so here or in a config file. | ||
# By default, queries listed here will override any specified in a config file. | ||
# Prefix the list here with "+" to use these queries and those in the config file. | ||
# queries: ./path/to/local/query, your-org/your-repo/queries@main | ||
|
||
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java). | ||
# If this step fails, then you should remove it and run the build manually (see below) | ||
- name: Autobuild | ||
uses: github/codeql-action/[email protected] | ||
|
||
# ℹ️ Command-line programs to run using the OS shell. | ||
# 📚 https://git.io/JvXDl | ||
|
||
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines | ||
# and modify them (or add more) to build your code if your project | ||
# uses a compiled language | ||
|
||
#- run: | | ||
# make bootstrap | ||
# make release | ||
|
||
- name: Perform CodeQL Analysis | ||
uses: github/codeql-action/[email protected] | ||
|
||
govulncheck: | ||
# https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck | ||
# https://github.com/golang/vuln | ||
|