cluckwork/.github/workflows/codeql.yml at main · mforce/cluckwork · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: CodeQL

# SAST (#146). CodeQL scans both languages in the repo and reports findings to
# the Security tab / PR "Code scanning" checks.
#
# Mode: ADVISORY. This workflow does not gate merges on its own — a finding shows
# as a neutral PR annotation, not a required failure, so a false positive can't
# wedge an unrelated PR. To gate on results, enable code-scanning merge
# protection in a branch ruleset (Settings → Rules → "Require code scanning
# results", pick the CodeQL tool and a severity threshold); nothing in this file
# has to change.
#
# build-mode: none — CodeQL's buildless analysis, so the scan needs neither the
# .NET SDK nor npm install. Chosen for speed and to avoid coupling the scan to a
# preview .NET 10 toolchain; if C# coverage ever needs the compiler's view,
# switch that language to build-mode: autobuild.

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    # Weekly, Monday 07:00 UTC — catches advisories in CodeQL's own query packs
    # that land between commits, so a quiet week is still scanned.
    - cron: "0 7 * * 1"

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze ${{ matrix.language }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      security-events: write # upload findings to the Security tab
      actions: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: csharp
          - language: javascript-typescript

    steps:
      - name: Check out repository
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: none
          # security-extended = the default security set plus lower-severity
          # security queries, but WITHOUT the maintainability/quality queries
          # that security-and-quality layers on. Those quality heuristics
          # (e.g. cs/path-combine flagging Path.Combine(dir, "literal.js") in a
          # test, where nothing is actually dropped) are false-positive noise on
          # a gate whose job is finding vulnerabilities. Keep the wider security
          # coverage; drop the quality bucket.
          queries: security-extended

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"