ci: run the weekly link check this repository already carried #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Two scanners nothing else here covers. | |
| # | |
| # CodeQL reads the code as a graph and asks questions a linter cannot: whether a | |
| # value from outside reaches something that trusts it, whether a path exists that | |
| # leaves state half-written. Very little of that applies to a processor model, | |
| # which takes integers and returns integers. What does apply is the fetch script, | |
| # which runs git against a repository named in a file, and the JSON readers that | |
| # decide what this project is held to. | |
| # | |
| # Scorecard reads the repository rather than the code: whether the workflows pin | |
| # what they run, whether branches are protected, whether a release is signed. It | |
| # is the check that notices the project drifting away from its own standards | |
| # rather than the code drifting away from correct. | |
| name: Analysis | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "57 6 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: analysis-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| codeql: | |
| name: CodeQL | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: github/codeql-action/init@v3 | |
| with: | |
| languages: python | |
| # Beyond the default set: the extended queries cover paths the default | |
| # ones consider too noisy for most projects. A script that shells out | |
| # to git with a path out of a file is exactly the case they are noisy | |
| # about. | |
| queries: security-extended,security-and-quality | |
| - uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:python" | |
| scorecard: | |
| name: Scorecard | |
| runs-on: ubuntu-latest | |
| # A pull request from a fork cannot be given the token this needs, and running | |
| # it there would fail for a reason that has nothing to do with the change. | |
| if: github.event_name != 'pull_request' | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| persist-credentials: false | |
| - uses: ossf/scorecard-action@v2.4.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # Publishes the score so the badge in the README reflects something | |
| # anybody can re-derive rather than a number this repository asserts. | |
| publish_results: true | |
| - uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: results.sarif |