junit-framework/.github/workflows/codeql.yml at main · thekillerturkey/junit-framework · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
name: "CodeQL"

on:
  push:
    branches:
      - main
      - 'releases/**'
  pull_request:
    # The branches below must be a subset of the branches above
    branches:
      - main
      - 'releases/**'
  schedule:
    - cron: '0 19 * * 3'

concurrency:
  # Cancels in-progress runs only for pull requests
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions: {}

env:
  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: actions
            build-mode: none
          - language: java-kotlin
            build-mode: manual
          - language: javascript
            build-mode: none
    steps:
    - name: Check out repository
      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
      with:
        persist-credentials: false
    - name: Initialize CodeQL
      uses: github/codeql-action/init@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        tools: linked
    - name: Build
      if: matrix.build-mode == 'manual'
      uses: ./.github/actions/run-gradle
      with:
        encryptionKey: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
        arguments: |
          --no-build-cache \
          -Dscan.tag.CodeQL \
          classes
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
      with:
        category: "/language:${{matrix.language}}"