test(readme): drive the succeeding-example arc rather than inherit it #104
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Two scanners nothing else here covers. | |
| # | |
| # CodeQL reads the code as a graph and asks questions a linter cannot: whether a | |
| # value from outside reaches something that trusts it, whether a path exists that | |
| # leaves state half-written. Very little of that applies to a processor model, | |
| # which takes integers and returns integers. What does apply is the firmware | |
| # loader and the manifest reader, which are the only places in the project that | |
| # open a file somebody else supplied. | |
| # | |
| # Scorecard reads the repository rather than the code: whether the workflows pin | |
| # what they run, whether branches are protected, whether a release is signed. It | |
| # is the check that notices the project drifting away from its own standards | |
| # rather than the code drifting away from correct. | |
| name: Analysis | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "41 6 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: analysis-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| codeql: | |
| name: CodeQL | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: github/codeql-action/init@v4 | |
| with: | |
| languages: python | |
| # Beyond the default set: the extended queries cover paths the default | |
| # ones consider too noisy for most projects. A file reader that decides | |
| # whether to trust its input is exactly the case they are noisy about. | |
| queries: security-extended,security-and-quality | |
| - uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:python" | |
| scorecard: | |
| name: Scorecard | |
| runs-on: ubuntu-latest | |
| # A pull request from a fork cannot be given the token this needs, and running | |
| # it there would fail for a reason that has nothing to do with the change. | |
| if: github.event_name != 'pull_request' | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - uses: ossf/scorecard-action@v2.4.4 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # Publishes the score so the badge in the README reflects something | |
| # anybody can re-derive rather than a number this repository asserts. | |
| publish_results: true | |
| - uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: results.sarif |