chore: sync from Nebutra-Sailor@f92579cf12ffa8ffcde2a88b6ee7b892c0112c80 #879
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Security Analysis | |
| # Runs GitHub's CodeQL SAST scanner on TypeScript and Python source code. | |
| # Results appear in the Security tab → Code scanning alerts. | |
| # | |
| # Runs on: | |
| # - Every push to main/develop | |
| # - Every PR targeting main/develop | |
| # - Weekly schedule (Sunday 03:00 Asia/Shanghai) to catch new CVEs in unchanged code | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| schedule: | |
| # Weekly scan — catches newly published CVEs in code that hasn't changed | |
| - cron: "0 19 * * 6" | |
| permissions: read-all | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: CodeQL Analysis (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: | |
| - javascript-typescript | |
| - python | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| # Dedicated config file owns all path exclusions and query filters | |
| # so they're version-controlled, reviewed on PR, and not buried inline. | |
| config-file: .github/codeql/codeql-config.yml | |
| # ── TypeScript: build for analysis ──────────────────────────────────── | |
| - name: Setup Node.js and pnpm | |
| if: matrix.language == 'javascript-typescript' | |
| uses: ./.github/actions/setup-node-pnpm | |
| # ── Python: setup for analysis ──────────────────────────────────────── | |
| - name: Setup Python | |
| if: matrix.language == 'python' | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install uv | |
| if: matrix.language == 'python' | |
| uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 | |
| # ── Run CodeQL analysis ─────────────────────────────────────────────── | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| # Upload results as SARIF to GitHub Security tab | |
| upload: true |