1# For most projects, this workflow file will not need changing; you simply need 2# to commit it to your repository. 3# 4# You may wish to alter this file to override the set of languages analyzed, 5# or to provide custom queries or build logic. 6# 7# ******** NOTE ******** 8# We have attempted to detect the languages in your repository. Please check 9# the `language` matrix defined below to confirm you have the correct set of 10# supported CodeQL languages. 11# 12name: "CodeQL Advanced" 13 14on: 15 push: 16 branches: [ "main" ] 17 pull_request: 18 branches: [ "main" ] 19 schedule: 20 - cron: '21 1 * * 0' 21 22jobs: 23 analyze: 24 name: Analyze (${{ matrix.language }}) 25 # Runner size impacts CodeQL analysis time. To learn more, please see: 26 # - https://gh.io/recommended-hardware-resources-for-running-codeql 27 # - https://gh.io/supported-runners-and-hardware-resources 28 # - https://gh.io/using-larger-runners (GitHub.com only) 29 # Consider using larger runners or machines with greater resources for possible analysis time improvements. 30 runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} 31 permissions: 32 # required for all workflows 33 security-events: write 34 35 # required to fetch internal or private CodeQL packs 36 packages: read 37 38 # only required for workflows in private repositories 39 actions: read 40 contents: read 41 42 strategy: 43 fail-fast: false 44 matrix: 45 include: 46 - language: actions 47 build-mode: none 48 - language: c-cpp 49 build-mode: autobuild 50 - language: python 51 build-mode: none 52 # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' 53 # Use `c-cpp` to analyze code written in C, C++ or both 54 # Use 'java-kotlin' to analyze code written in Java, Kotlin or both 55 # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both 56 # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, 57 # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. 58 # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how 59 # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages 60 steps: 61 - name: Checkout repository 62 uses: actions/checkout@v4 63 64 # Add any setup steps before running the `github/codeql-action/init` action. 65 # This includes steps like installing compilers or runtimes (`actions/setup-node` 66 # or others). This is typically only required for manual builds. 67 # - name: Setup runtime (example) 68 # uses: actions/setup-example@v1 69 70 # Initializes the CodeQL tools for scanning. 71 - name: Initialize CodeQL 72 uses: github/codeql-action/init@v3 73 with: 74 languages: ${{ matrix.language }} 75 build-mode: ${{ matrix.build-mode }} 76 # If you wish to specify custom queries, you can do so here or in a config file. 77 # By default, queries listed here will override any specified in a config file. 78 # Prefix the list here with "+" to use these queries and those in the config file. 79 80 # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs 81 # queries: security-extended,security-and-quality 82 83 # If the analyze step fails for one of the languages you are analyzing with 84 # "We were unable to automatically build your code", modify the matrix above 85 # to set the build mode to "manual" for that language. Then modify this step 86 # to build your code. 87 # ℹ️ Command-line programs to run using the OS shell. 88 # �� See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun 89 - if: matrix.build-mode == 'manual' 90 shell: bash 91 run: | 92 echo 'If you are using a "manual" build mode for one or more of the' \ 93 'languages you are analyzing, replace this with the commands to build' \ 94 'your code, for example:' 95 echo ' make bootstrap' 96 echo ' make release' 97 exit 1 98 99 - name: Perform CodeQL Analysis 100 uses: github/codeql-action/analyze@v3 101 with: 102 category: "/language:${{matrix.language}}" 103