microsoft/hve-core
Publicmirrored fromhttps://github.com/microsoft/hve-coreAvailable
.github/workflows/codeql-analysis.yml
56lines · modecode
| 1 | name: CodeQL Security Analysis |
| 2 | |
| 3 | on: |
| 4 | schedule: |
| 5 | # Weekly scan: Sundays at 4 AM UTC |
| 6 | - cron: '0 4 * * 0' |
| 7 | workflow_call: |
| 8 | |
| 9 | permissions: |
| 10 | contents: read |
| 11 | security-events: write |
| 12 | |
| 13 | jobs: |
| 14 | analyze: |
| 15 | name: CodeQL Analysis |
| 16 | runs-on: ubuntu-latest |
| 17 | permissions: |
| 18 | contents: read |
| 19 | security-events: write |
| 20 | actions: read |
| 21 | |
| 22 | strategy: |
| 23 | fail-fast: false |
| 24 | matrix: |
| 25 | # Repository contains GitHub Actions workflows, PowerShell, and shell scripts |
| 26 | # CodeQL supports 'actions' for workflow security scanning |
| 27 | language: [ 'actions' ] |
| 28 | |
| 29 | steps: |
| 30 | - name: Checkout repository |
| 31 | uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.2.2 |
| 32 | with: |
| 33 | persist-credentials: false |
| 34 | |
| 35 | - name: Initialize CodeQL |
| 36 | uses: github/codeql-action/init@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0 |
| 37 | with: |
| 38 | languages: ${{ matrix.language }} |
| 39 | queries: security-extended,security-and-quality |
| 40 | |
| 41 | - name: Autobuild |
| 42 | uses: github/codeql-action/autobuild@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0 |
| 43 | |
| 44 | - name: Perform CodeQL Analysis |
| 45 | uses: github/codeql-action/analyze@ce729e4d353d580e6cacd6a8cf2921b72e5e310a # v3.27.0 |
| 46 | with: |
| 47 | category: "/language:${{ matrix.language }}" |
| 48 | |
| 49 | - name: Add job summary |
| 50 | if: always() |
| 51 | run: | |
| 52 | echo "## CodeQL Security Analysis Complete" >> $GITHUB_STEP_SUMMARY |
| 53 | echo "**Language:** ${{ matrix.language }}" >> $GITHUB_STEP_SUMMARY |
| 54 | echo "**Queries:** security-extended, security-and-quality" >> $GITHUB_STEP_SUMMARY |
| 55 | echo "" >> $GITHUB_STEP_SUMMARY |
| 56 | echo "📊 View results in the Security tab under Code Scanning" >> $GITHUB_STEP_SUMMARY |
| 57 | |