Skip to content

zones: a layout can keep its own gap (#89) #36

zones: a layout can keep its own gap (#89)

zones: a layout can keep its own gap (#89) #36

Workflow file for this run

name: CodeQL
# Static analysis of the Swift app, on GitHub's free tier for public
# repositories. It reads the code the way an attacker would rather than the way
# a compiler does, so what it catches is the class of thing tests do not: a
# value that reaches a shell, a path built from something a caller controls.
#
# Findings land in the Security tab. `security-and-quality` is the wider of the
# two query suites, so some of what it reports is a correctness smell rather
# than a vulnerability; both are worth a look on a codebase this size.
# Read by default. The analysis job asks below for the one write scope it
# needs, security-events, to file its findings under the Security tab.
permissions:
contents: read
on:
push:
branches: [main]
# Only when the Swift actually changed. Every pull request used to start a
# macOS build here, which meant a Dependabot bump to a TypeScript type
# package spent twenty minutes analysing Swift that was byte for byte the
# same as the last run. `push` above stays unfiltered, so main is still
# analysed on every commit and the Security tab cannot go stale.
pull_request:
branches: [main]
paths:
- "App/**"
- ".github/workflows/codeql.yml"
schedule:
# Weekly, because a query suite that ships a new rule should find last
# week's code with it, not wait for the next commit to that file.
- cron: "27 5 * * 1"
# A second push to a branch makes the first run's answer worthless, and this
# one holds a macOS runner for eighteen minutes to produce it. Without this
# block GitHub lets both run to the end.
#
# Pull requests only. A push to main gets a group of its own, keyed by the
# commit, because a shared one is not a queue: GitHub keeps one pending run
# per group and drops the rest, so three merges in a quarter of an hour left
# two commits on main unanalysed and the badge reading "cancelled". The
# Security tab is meant to describe main at all times, so every push runs.
concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
analyze:
name: Analyze Swift
# Swift analysis only runs on macOS, and macos-14 still ships Swift 5.10
# while Package.swift asks for tools version 6.0 — the same reason
# ci.yml pins its Swift jobs above it.
runs-on: macos-latest
timeout-minutes: 90
permissions:
security-events: write # write the findings to the Security tab
contents: read
actions: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
with:
languages: swift
queries: security-and-quality
# Manual rather than autobuild. Autobuild exists to guess at an
# Xcode project and a scheme, and there is no .xcodeproj or
# .xcworkspace in this repository to guess at: the app is a Swift
# package under App/, built by the one command below. Naming it is
# both shorter than the guess and the same command scripts/build.sh
# runs, so the tree CodeQL reads is the tree that ships.
build-mode: manual
# Debug rather than `-c release` as in scripts/build.sh: CodeQL reads the
# source through the compiler as it runs, and the optimiser makes no
# difference to what it sees. This is the line ci.yml already builds with.
- name: Build
run: swift build
working-directory: App
- uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
with:
category: "/language:swift"