v1.98.52 — re-trigger release flow (v1.98.51 had CI runner mid-test k… #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # CodeQL does not have first-class PowerShell support, but several parts of | |
| # the RackStack toolchain are JavaScript (the inline scripts in | |
| # actions/github-script steps, e.g. powershell-scan.yml's Issue updater). | |
| # Scanning JavaScript catches injection / RCE bugs in those scripts before | |
| # they ship. GitHub Actions workflows themselves are also analyzed. | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| branches: [master] | |
| schedule: | |
| - cron: '0 7 * * 1' # weekly Monday morning UTC | |
| workflow_dispatch: | |
| permissions: read-all | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # GitHub Actions language covers our workflow YAML files AND the JS | |
| # embedded in actions/github-script steps. We don't ship standalone | |
| # .js / .ts source, so the dedicated javascript-typescript analyzer | |
| # has nothing to scan and fails with "no source code seen during build". | |
| - language: actions | |
| build-mode: none | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| # security-extended adds rules for secret-leak via logging, | |
| # tainted-data-flow, and the GitHub Actions ruleset (action-injection, | |
| # untrusted-checkout, etc.). | |
| queries: security-extended | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" |