mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
290ce3441a
Dependabot treats `init`, `analyze` and `upload-sarif` as separate dependencies, so it raised `init` to 4.37.7 in one PR and left `analyze` on 4.37.6 in the same workflow. The action refuses that pairing outright: "Loaded a configuration file for version '4.37.7', but running version '4.37.6'", and the CodeQL job failed on the very PR doing the bump. All five pinned references move together here: init and analyze in codeql.yml, and the three upload-sarif steps in scorecard.yml and trivy.yml. The commit SHA is the one the v4.37.7 tag dereferences to, which is also the SHA both Dependabot PRs pin.
74 lines
2.5 KiB
YAML
74 lines
2.5 KiB
YAML
name: CodeQL
|
|
|
|
# Static analysis for the TypeScript tree. This is GitHub's default setup
|
|
# expressed as a workflow file rather than enabled from the repository
|
|
# settings, so the query suite, the excluded paths and the schedule are
|
|
# reviewable in the diff like everything else here.
|
|
#
|
|
# Deliberately NOT on `push: main`. The weekly run already analyses the
|
|
# default branch, which is what keeps the Security tab current, and every
|
|
# change reaches `main` through a pull request that is analysed on the way
|
|
# in. Adding a push trigger would analyse the same tree a second time
|
|
# minutes later for no additional signal.
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
schedule:
|
|
# Mondays, 04:27 UTC. Off the hour so the run does not queue behind
|
|
# everyone else's midnight cron.
|
|
- cron: "27 4 * * 1"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyse javascript-typescript
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: read
|
|
# Required to write the results into the repository's code-scanning
|
|
# alerts. Free for public repositories.
|
|
security-events: write
|
|
# Required by the CodeQL action to read workflow run metadata.
|
|
actions: read
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
# `build-mode: none` is the correct mode for JavaScript/TypeScript —
|
|
# CodeQL extracts from source and needs neither a compile step nor
|
|
# installed dependencies.
|
|
#
|
|
# The excluded paths are all generated or vendored output. Chief
|
|
# among them is `src/generated`, the ~9 MB Prisma client with a
|
|
# 224 KB inline schema literal in it: extracting that costs real
|
|
# minutes and can produce nothing actionable, because nobody edits
|
|
# it and the fix for anything found there is `pnpm prisma generate`.
|
|
- name: Initialise CodeQL
|
|
uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
|
with:
|
|
languages: javascript-typescript
|
|
build-mode: none
|
|
config: |
|
|
paths-ignore:
|
|
- src/generated
|
|
- .next
|
|
- dist
|
|
- coverage
|
|
- playwright-report
|
|
- test-results
|
|
- public
|
|
|
|
- name: Analyse
|
|
uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
|
|
with:
|
|
category: "/language:javascript-typescript"
|