nix-security-tracker/.github/workflows/codeql.yaml at 285c14686fd6619fc214b7a29cfdb645f15a8696 · NixOS/nix-security-tracker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
name: "CodeQL"

on:
  pull_request:
  merge_group:
  push:
    branches: main
  workflow_dispatch:

permissions:
  actions: read
  contents: read

jobs:
  codeql:
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Needed to report back the findins of CodeQL
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
      - name: Initialize CodeQL
        uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
        with:
          languages: "python"
          queries: security-and-quality
          config-file: .github/codeql/codeql-config.yaml
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
        with:
          category: "/language:python"