zones: a layout can keep its own gap (#89) #36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Static analysis of the Swift app, on GitHub's free tier for public | |
| # repositories. It reads the code the way an attacker would rather than the way | |
| # a compiler does, so what it catches is the class of thing tests do not: a | |
| # value that reaches a shell, a path built from something a caller controls. | |
| # | |
| # Findings land in the Security tab. `security-and-quality` is the wider of the | |
| # two query suites, so some of what it reports is a correctness smell rather | |
| # than a vulnerability; both are worth a look on a codebase this size. | |
| # Read by default. The analysis job asks below for the one write scope it | |
| # needs, security-events, to file its findings under the Security tab. | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: [main] | |
| # Only when the Swift actually changed. Every pull request used to start a | |
| # macOS build here, which meant a Dependabot bump to a TypeScript type | |
| # package spent twenty minutes analysing Swift that was byte for byte the | |
| # same as the last run. `push` above stays unfiltered, so main is still | |
| # analysed on every commit and the Security tab cannot go stale. | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "App/**" | |
| - ".github/workflows/codeql.yml" | |
| schedule: | |
| # Weekly, because a query suite that ships a new rule should find last | |
| # week's code with it, not wait for the next commit to that file. | |
| - cron: "27 5 * * 1" | |
| # A second push to a branch makes the first run's answer worthless, and this | |
| # one holds a macOS runner for eighteen minutes to produce it. Without this | |
| # block GitHub lets both run to the end. | |
| # | |
| # Pull requests only. A push to main gets a group of its own, keyed by the | |
| # commit, because a shared one is not a queue: GitHub keeps one pending run | |
| # per group and drops the rest, so three merges in a quarter of an hour left | |
| # two commits on main unanalysed and the badge reading "cancelled". The | |
| # Security tab is meant to describe main at all times, so every push runs. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| analyze: | |
| name: Analyze Swift | |
| # Swift analysis only runs on macOS, and macos-14 still ships Swift 5.10 | |
| # while Package.swift asks for tools version 6.0 — the same reason | |
| # ci.yml pins its Swift jobs above it. | |
| runs-on: macos-latest | |
| timeout-minutes: 90 | |
| permissions: | |
| security-events: write # write the findings to the Security tab | |
| contents: read | |
| actions: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| languages: swift | |
| queries: security-and-quality | |
| # Manual rather than autobuild. Autobuild exists to guess at an | |
| # Xcode project and a scheme, and there is no .xcodeproj or | |
| # .xcworkspace in this repository to guess at: the app is a Swift | |
| # package under App/, built by the one command below. Naming it is | |
| # both shorter than the guess and the same command scripts/build.sh | |
| # runs, so the tree CodeQL reads is the tree that ships. | |
| build-mode: manual | |
| # Debug rather than `-c release` as in scripts/build.sh: CodeQL reads the | |
| # source through the compiler as it runs, and the optimiser makes no | |
| # difference to what it sees. This is the line ci.yml already builds with. | |
| - name: Build | |
| run: swift build | |
| working-directory: App | |
| - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| category: "/language:swift" |