terraform-provider-github/.github/workflows/codeql.yaml at 8a19e76dc4892be74b526ea210472ee50d4eaa07 · integrations/terraform-provider-github · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
name: CodeQL

on:
    workflow_dispatch:
    push:
        branches: ["main"]
    pull_request:
        # The branches below must be a subset of the branches above
        branches: ["main"]
    schedule:
        - cron: "16 7 * * 5"

concurrency:
    group: codeql-${{ github.ref }}
    cancel-in-progress: true

permissions: read-all

jobs:
    analyze:
        name: Analyze (${{ matrix.language }})
        runs-on: ubuntu-latest
        permissions:
            actions: read
            contents: read
            security-events: write
        strategy:
            fail-fast: false
            matrix:
                include:
                    - language: actions
                      build-mode: none
                      queries: security-extended # can be 'default' (use empty for 'default'), 'security-and-quality', 'security-extended'
                    - language: go
                      build-mode: manual
                      queries: "" # will be used 'default' queries
        defaults:
            run:
                shell: bash
        steps:
            - name: Checkout
              uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0

            - name: Set-up Go
              uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
              if: matrix.language == 'go'
              with:
                  go-version-file: go.mod
                  cache: true

            - name: Initialize CodeQL
              uses: github/codeql-action/init@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
              with:
                  languages: ${{ matrix.language }}
                  build-mode: ${{ matrix.build-mode }}
                  queries: ${{ matrix.queries }}

            - name: Build Go
              if: ${{ matrix.language == 'go' }}
              run: go build ./...

            - name: Perform CodeQL Analysis
              uses: github/codeql-action/analyze@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
              with:
                  category: "/language:${{matrix.language}}"

    check:
        name: Check CodeQL Analysis
        if: always() && github.event_name == 'pull_request'
        needs:
            - analyze
        runs-on: ubuntu-latest
        defaults:
            run:
                shell: bash
        steps:
            - name: Check
              env:
                  INPUT_RESULTS: ${{ join(needs.*.result, ' ') }}
              run: |
                  set -euo pipefail
                  read -a results <<< "${INPUT_RESULTS}"
                  for result in "${results[@]}"; do
                    if [[ "${result}" == "failure" ]] || [[ "${result}" == "cancelled" ]]; then
                      echo "::error::Workflow failed!"
                      exit 1
                    fi
                  done