diff options
| author | Leitwolf11 | 2026-11-05 07:00:01 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-11-05 07:00:01 +0300 |
| commit | 77a86bbd91a603e04fb64338a31d1bd8e9a13b22 (patch) | |
| tree | 4d073abeac0eb2cc5cd7a1ea5fc9bf511bb58d3c /.github/workflows/codeql.yml | |
| parent | 52490ff852f3d72ce9c9eb76898080223e9e17fd (diff) | |
| download | tazelish-77a86bbd91a603e04fb64338a31d1bd8e9a13b22.tar.gz | |
Add CodeQL, Codecov, Codacy, Renovate and actionlint
- CodeQL analyses the workflows and the C++ sources, without a build,
with the security-extended queries, on every push to main, every pull
request and once a week.
- A coverage job runs the tests under Clang's own coverage on Linux and
a job of its own uploads the lcov report to Codecov through OIDC.
- .codacy.yml leaves out the output of Bazel and the rules_cc patch.
- Renovate proposes Bazel modules, Bazel itself and GitHub Actions once
a week, a week after their release; rules_cc waits for approval on
the dashboard, since its clang-cl patch has to be checked first.
- actionlint joins zizmor in Workflow Security.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to '.github/workflows/codeql.yml')
| -rw-r--r-- | .github/workflows/codeql.yml | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..388864c --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,36 @@ +# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> +# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0 + +name: CodeQL +on: + push: + branches: [main] + pull_request: + schedule: + - cron: "29 5 * * 1" +permissions: + actions: read + contents: read + security-events: write +jobs: + analyze: + name: ${{ matrix.language }} + runs-on: ubuntu-latest + timeout-minutes: 30 + strategy: + fail-fast: false + matrix: + language: [actions, c-cpp] + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4 + with: + languages: ${{ matrix.language }} + build-mode: none + config-file: ./.github/codeql/codeql-config.yml + queries: security-extended + - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4 + with: + category: /language:${{ matrix.language }} |