poly-ssg/.github/workflows/codeql.yml at main · hyperpolymath/poly-ssg · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
# SPDX-License-Identifier: MPL-2.0-or-later
name: CodeQL Security Analysis
on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 6 * * 1'
permissions:
  contents: read
  actions: read
jobs:
  analyze:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
      actions: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: javascript-typescript
            build-mode: none
    steps:
      - name: Checkout immutable subject and retained ancestry
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false
      - name: Initialize CodeQL
        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v3.28.1
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          category: /language:${{ matrix.language }}
          output: ${{ runner.temp }}/codeql-sarif
          # This private repository has no hosted code-scanning entitlement.
          # Keep actual analysis and complete SARIF; do not turn upload errors into success.
          upload: never
          upload-database: false
      - name: Classify retained findings and block current findings
        run: bash scripts/review-preservation-sarif.sh codeql "$RUNNER_TEMP/codeql-sarif/javascript.sarif" "$RUNNER_TEMP/codeql-sarif/disposition"
      - name: Retain complete analysis and disposition
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: codeql-${{ matrix.language }}-${{ github.event.pull_request.head.sha || github.sha }}
          path: ${{ runner.temp }}/codeql-sarif
          if-no-files-found: error
          retention-days: 90