mirror of
https://github.com/fusion44/blitz_api.git
synced 2026-08-13 11:52:45 +02:00
ba78b10aa2
- run on the actual default branch: the workflow only triggered on main, but the default branch is dev, so pushes were never analyzed - bump github/codeql-action from the deprecated v1/v2 to v4 and actions/checkout from v2 (node12, disabled by GitHub) to v7 - fix the stale paths-ignore: the generated protos moved from app/repositories/ln_impl/protos to app/lightning/impl/protos long ago, and exclude them from the analysis itself via the init config (trigger-level paths-ignore only affects when the workflow runs) - also scan the GitHub Actions workflows (language: actions) - drop the Autobuild step (a no-op for Python) and the template boilerplate comments - allow manual CodeQL runs via workflow_dispatch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
49 lines
1.2 KiB
YAML
49 lines
1.2 KiB
YAML
name: "CodeQL"
|
|
|
|
on:
|
|
push:
|
|
branches: [dev, main]
|
|
paths-ignore:
|
|
- "app/lightning/impl/protos/**"
|
|
pull_request:
|
|
# The branches below must be a subset of the branches above
|
|
branches: [dev, main]
|
|
paths-ignore:
|
|
- "app/lightning/impl/protos/**"
|
|
schedule:
|
|
- cron: "20 11 * * 4"
|
|
# allow triggering manually from the Actions tab / gh workflow run
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
security-events: write
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# 'actions' scans the GitHub Actions workflows themselves
|
|
language: ["python", "actions"]
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v4
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
# exclude generated protobuf code from analysis
|
|
config: |
|
|
paths-ignore:
|
|
- app/lightning/impl/protos
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@v4
|
|
with:
|
|
category: "/language:${{ matrix.language }}"
|