Spaces:
Paused
Paused
| name: "CodeQL" | |
| on: | |
| push: | |
| branches: ["master", "[0-9].[0-9]*"] | |
| pull_request: | |
| # The branches below must be a subset of the branches above | |
| branches: ["master"] | |
| schedule: | |
| - cron: "0 4 * * *" | |
| # cancel previous workflow jobs for PRs | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-26.04 | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| python: ${{ steps.check.outputs.python }} | |
| frontend: ${{ steps.check.outputs.frontend }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Check for file changes | |
| id: check | |
| uses: ./.github/actions/change-detector/ | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| analyze: | |
| name: Analyze | |
| needs: changes | |
| # Skip on PRs that touch neither code group (e.g. docs-only) so the | |
| # analysis runners don't spin up. push/schedule runs always proceed: | |
| # the change-detector returns "all changed" for non-PR events. | |
| if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true' | |
| runs-on: ubuntu-26.04 | |
| timeout-minutes: 30 | |
| permissions: | |
| actions: read | |
| contents: read | |
| pull-requests: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ["python", "javascript"] | |
| # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # Initializes the CodeQL tools for scanning. | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # If you wish to specify custom queries, you can do so here or in a config file. | |
| # By default, queries listed here will override any specified in a config file. | |
| # Prefix the list here with "+" to use these queries and those in the config file. | |
| # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs | |
| # queries: security-extended,security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| category: "/language:${{matrix.language}}" | |