fix(llm): use canonical Pylon bootstrap flags #101
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: codeql | |
| on: | |
| push: | |
| branches: [main] | |
| # Only run when compiled source or this workflow changes. Docs, charts, | |
| # migrations, and other non-code PRs skip the scan (the Go autobuild is | |
| # expensive). The weekly schedule still does a full unconditional scan. | |
| paths: | |
| - "src/**" | |
| - "**/*.go" | |
| - "**/*.rs" | |
| - "**/go.mod" | |
| - "**/go.sum" | |
| - "**/Cargo.toml" | |
| - "**/Cargo.lock" | |
| - ".github/workflows/codeql.yml" | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "src/**" | |
| - "**/*.go" | |
| - "**/*.rs" | |
| - "**/go.mod" | |
| - "**/go.sum" | |
| - "**/Cargo.toml" | |
| - "**/Cargo.lock" | |
| - ".github/workflows/codeql.yml" | |
| schedule: | |
| # Weekly full scan, Monday 03:27 UTC. | |
| - cron: "27 3 * * 1" | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| jobs: | |
| analyze: | |
| name: CodeQL (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| # Keep one language's failure from cancelling the others. | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Go is a traced language and does not support build-mode none, so it | |
| # autobuilds. Rust has no autobuilder and uses buildless extraction. | |
| - language: go | |
| build-mode: autobuild | |
| - language: rust | |
| build-mode: none | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| # CodeQL does not need the repo token after checkout. | |
| persist-credentials: false | |
| - name: CodeQL Analysis | |
| uses: NVIDIA/dsx-github-actions/.github/actions/codeql-scan@9a9ce3a7770a8b53d2726afa920be3276bc3ddd7 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| upload-sarif: true | |
| # Same-repository PRs can comment here. Fork PRs have a read-only token | |
| # and are handled by the companion codeql-comment.yml workflow. | |
| post-pr-comment: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }} | |
| # Non-blocking during rollout: findings surface in the Security tab and | |
| # as a PR comment, but do not gate merges yet. Tighten once triaged. | |
| fail-on-findings: false | |
| - name: Upload CodeQL results for fork PR comment | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| # The companion workflow parses this artifact as untrusted data only. | |
| name: codeql-pr-results-${{ matrix.language }} | |
| path: results/${{ matrix.language }}.sarif | |
| if-no-files-found: error | |
| retention-days: 1 | |
| - name: Prepare fork PR metadata | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && matrix.language == 'go' }} | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| mkdir -p "${RUNNER_TEMP}/codeql-pr-metadata" | |
| printf '%s\n' "$PR_NUMBER" > "${RUNNER_TEMP}/codeql-pr-metadata/pr-number" | |
| - name: Upload fork PR metadata | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository && matrix.language == 'go' }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: codeql-pr-metadata | |
| path: ${{ runner.temp }}/codeql-pr-metadata/pr-number | |
| if-no-files-found: error | |
| retention-days: 1 |