ssh-manager/.github/workflows/codeql.yml at main · simtabi/ssh-manager · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: CodeQL

on:
  workflow_dispatch:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 6 * * 1"   # Mondays 06:00 UTC

permissions:
  contents: read

jobs:
  analyze:
    # Code scanning needs GitHub Advanced Security on private repos, which this
    # repo does not have. Run only when public, so it self-activates at go-public
    # without failing every push while private.
    if: github.event.repository.visibility == 'public'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      # A job-level permissions block REPLACES the workflow-level one, so
      # checkout needs contents:read explicitly to clone the (private) repo.
      contents: read
      actions: read            # read workflow metadata (needed on private repos)
      security-events: write   # upload results to the Security tab
    strategy:
      fail-fast: false
      matrix:
        # Scan the Go code and the workflow files themselves. This named the wrong language
        # until the rewrite landed, so the product went unscanned: the code it
        # was aimed at is gone, and the Go that replaced it was never analysed.
        language: [go, actions]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # Pin the toolchain from go.mod. CodeQL's autobuild otherwise uses whatever
      # Go the runner image ships, which need not satisfy the module's directive.
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        if: matrix.language == 'go'
        with:
          go-version-file: src/go.mod
          # No build cache here, deliberately. CodeQL learns what the code is by
          # observing the compiler run; a restored cache makes `go build` a no-op
          # and it observes nothing, which is what "detected code written in Go
          # but this run didn't build any of it" means. The scan then fails - or,
          # worse on a different day, reports a clean result for a codebase it
          # never read.
          cache: false
      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          languages: ${{ matrix.language }}
          # Go must be built for CodeQL to read it - the extractor works from a
          # compiler run, and the toolchain rejects the alternative outright:
          # "Go does not support the none build mode."
          #
          # autobuild rather than manual. A manual step was tried twice, as
          # `make build-all` and then as `go build -a` with the cache disabled;
          # both succeeded and CodeQL still reported "detected code written in Go
          # but this run didn't build any of it". autobuild locates go.mod under
          # src/ by itself and builds inside its own tracing context, which is
          # the part a separate run step was not participating in.
          #
          # There is no silent-success risk in leaving it to autobuild: a build
          # that finds nothing produces exactly that error and fails the job,
          # which is the vacuity check.
          # Per language, because the two require opposite modes and each
          # rejects the other's: "Go does not support the none build mode" and
          # "GitHub Actions does not support the autobuild build mode".
          build-mode: ${{ matrix.language == 'go' && 'autobuild' || 'none' }}
      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6