ci: bump the actions-all group across 1 directory with 9 updates #33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Static application security testing (SAST) for the Python sources across | |
| # all workspace packages. Runs CodeQL's security-extended query suite on | |
| # pull requests, pushes to main, and a weekly schedule, uploading results | |
| # to the GitHub Security tab. | |
| # | |
| # Closes the OpenSSF Scorecard "SAST" gap: CodeQL statically analyzes the | |
| # first-party source, complementing the dependency-vulnerability scanning | |
| # (pip-audit) that runs separately. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| schedule: | |
| # Wednesdays 06:00 UTC | |
| - cron: "0 6 * * 3" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (python) | |
| # Code scanning (SARIF upload) requires GitHub Code Security, which is | |
| # only available on public repos. Gate on visibility so the job only | |
| # runs when the repo is public. | |
| if: ${{ github.event.repository.visibility == 'public' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Required for CodeQL to upload its SARIF results to code scanning. | |
| security-events: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # build-mode: none — CodeQL analyzes Python sources directly, no | |
| # compilation step required. | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 | |
| with: | |
| languages: python | |
| build-mode: none | |
| queries: security-extended | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 | |
| with: | |
| category: "/language:python" |