CodeQL Advanced #443
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL Advanced" | |
| # ⚠️ TEMPORARY STATE: Upload disabled to prevent conflicts | |
| # This workflow runs but doesn't upload results until GitHub default setup is disabled | |
| # | |
| # CURRENT: GitHub's default CodeQL is active (provides basic scanning) | |
| # FUTURE: To use this advanced workflow with custom queries: | |
| # 1. Go to: Settings → Code security and analysis → Code scanning | |
| # 2. Under "CodeQL analysis", change from "Default" to "Advanced" | |
| # 3. Update line 55: upload: false → upload: true | |
| # 4. Remove line 57: continue-on-error: true | |
| # | |
| # Benefits of custom workflow (after enabling): | |
| # - Enhanced queries (+security-and-quality) | |
| # - Weekly scheduled scans | |
| # - More configuration control | |
| on: | |
| push: | |
| branches: [ "main", "simplify-workflow-to-main-only" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| schedule: | |
| - cron: '30 1 * * 1' # Run every Monday at 1:30 AM UTC | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 360 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: go | |
| build-mode: autobuild | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@08bc0cf022445eacafaa248bf48da20f26b8fd40 # v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| queries: +security-and-quality | |
| - if: matrix.build-mode == 'manual' | |
| name: Manual Build | |
| shell: bash | |
| run: | | |
| echo 'Manual build not required for Go with autobuild' | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@08bc0cf022445eacafaa248bf48da20f26b8fd40 # v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| output: sarif-results | |
| upload: true # Enabled to unblock PR merges |