chore(deps): bump github/codeql-action/init from 4.37.3 to 4.37.6 #4421
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # No paths-ignore here on purpose: branch protection has a 'Require code | |
| # scanning results' rule that waits for a CodeQL SARIF upload for each PR | |
| # head commit. If paths-ignore prevents this workflow from running on a | |
| # docs-only PR, no SARIF ever gets uploaded and the PR blocks forever | |
| # (see #191 - NOTICE.md-only PR that couldn't merge). All configured | |
| # languages use build-mode none, so running on a docs-only PR is cheap and | |
| # paying that cost beats the merge deadlock. | |
| # | |
| # No merge_group trigger on purpose: CodeQL isn't a required merge-queue | |
| # check, and the queue deletes its temporary gh-readonly-queue ref the | |
| # moment an entry merges. CodeQL would analyze that ref and then 404 on the | |
| # SARIF upload ("ref ... not found") — a noisy red X that gates nothing. | |
| # pull_request already gates PRs and push:main scans the merged result, so | |
| # scanning the ephemeral merge-queue ref adds no coverage. | |
| schedule: | |
| - cron: "0 6 * * 1" # Weekly on Monday at 06:00 UTC | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| security-events: write | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: | |
| - actions | |
| - csharp | |
| - javascript-typescript | |
| - python | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: none | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| category: "/language:${{ matrix.language }}" |