gha-firebase/.github/workflows/codeql.yml at main · EnturWilhelm/gha-firebase · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
#
# Shared Workflows - CodeQL Scan
#
# Reusable Workflows used:
# * Code Scan
#   * Readme <https://github.com/entur/gha-security/blob/main/README-code-scan.md>
#   * Owner: Team Sikkerhet
#   * Slack: #talk-sikkerhet
#
# TODO: This file comes from entur/.github/workflow-templates/codeql.yml
#       Adopt to your needs, this file is yours now.
#
name: CodeQL Scan

on:
  pull_request:
    branches:
      - "main"
  push:
    branches:
      - "main"
    paths-ignore:
      - "**/README*" # Ignore README files
  schedule:
    - cron: "0 3 * * 1-5" # Run Monday to Friday at 3AM UTC

permissions:
  actions: read
  contents: write # dependency graph and code scanning alerts
  pull-requests: write # upload events
  security-events: write # dependency graph and code scanning alerts
  issues: write # upload events

jobs:
  code-scan:
    name: CodeQL Scan
    uses: entur/gha-security/.github/workflows/code-scan.yml@v2
    secrets: inherit