CodeQL #1912
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Why a dedicated workflow (AAASM-3432): the agent-assembly default branch | |
| # recorded ZERO CodeQL analyses (code-scanning/analyses -> 404, default-setup | |
| # not-configured). Code scanning only updates the repo's security tab when an | |
| # analysis is uploaded from a `push` to the default branch, so this workflow | |
| # triggers on push to main (not just pull_request) plus a weekly schedule. | |
| # Mirrors the known-good go-sdk codeql.yml, adapted for this Rust + TS/JS repo. | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| paths-ignore: | |
| - "**/*.md" | |
| - "LICENSE" | |
| push: | |
| paths-ignore: | |
| - "**/*.md" | |
| - "LICENSE" | |
| branches: | |
| - main | |
| schedule: | |
| - cron: "0 3 * * 1" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # build-mode: none — CodeQL extracts source directly without a full | |
| # workspace build. Keeps the analysis cheap and avoids the eBPF / | |
| # cross-target build complexity that the main CI handles separately. | |
| - language: rust | |
| build-mode: none | |
| - language: javascript-typescript | |
| build-mode: none | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| submodules: recursive | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@65216971a11ded447a6b76263d5a144519e5eee1 # codeql-bundle-v2.25.2 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@65216971a11ded447a6b76263d5a144519e5eee1 # codeql-bundle-v2.25.2 | |
| with: | |
| category: "/language:${{ matrix.language }}" |