async-test-lib/.github/workflows/codeql.yml at main · PIsberg/async-test-lib · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"

on:
  push:
    branches: ["main"]
    # Prose and pictures cannot change what this workflow tests. Kept narrow on purpose:
    # no source, build file or workflow path is listed. The workflows carrying a required
    # status context are deliberately not filtered - a required check that never reports
    # leaves the pull request permanently BLOCKED, which is worse than the fan-out (#484).
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
      - '.github/ISSUE_TEMPLATE/**'
      - 'LICENSE'
  pull_request:
    # The branches below must be a subset of the branches above
    branches: ["main"]
    # Prose and pictures cannot change what this workflow tests. Kept narrow on purpose:
    # no source, build file or workflow path is listed. The workflows carrying a required
    # status context are deliberately not filtered - a required check that never reports
    # leaves the pull request permanently BLOCKED, which is worse than the fan-out (#484).
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
      - '.github/ISSUE_TEMPLATE/**'
      - 'LICENSE'
  schedule:
    - cron: "0 0 * * 1"

concurrency:
  # One run per workflow per ref. cancel-in-progress only for pull requests: a superseded
  # push has nothing to say, while a run on main or a schedule is the record of that commit
  # and must finish. Without this a force-push left the previous run alive and both competed
  # for the same runners (#484).
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: ["java"]
        # CodeQL supports [ $supported-codeql-languages ]
        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support

    steps:
      - name: Harden the runner (Block unexpected outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: block
          allowed-endpoints: >
            agent.api.stepsecurity.io:443
            api.adoptium.net:443
            api.github.com:443
            github.com:443
            ghcr.io:443
            github-releases.githubusercontent.com:443
            objects.githubusercontent.com:443
            pkg-containers.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            repo.maven.apache.org:443
            repo1.maven.org:443
            uploads.github.com:443

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # Initializes the CodeQL tools for scanning.
      # build-mode: none scans Java from source without building. The repo has
      # BOTH Maven and Gradle builds, and autobuild's build-system heuristics
      # picked Gradle — whose wrapper then had its distribution download blocked
      # by the harden-runner egress allowlist. No build, no ambiguity.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
        with:
          languages: ${{ matrix.language }}
          build-mode: none
          # If you wish to specify custom queries, you can do so here or in a config file.
          # By default, queries listed here will override any specified in a config file.
          # Prefix the list here with "+" to use these queries and those in the config file.

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
        with:
          category: "/language:${{matrix.language}}"