CodeQL Scan #2971

	name: "CodeQL Scan"

	on:
	push:
	branches: ["develop", "releases/*"]
	pull_request:
	branches: ["develop", "releases/*"]
	schedule:
	- cron: "0 0 * * *"

	permissions: {} # No permissions by default on workflow level

	jobs:
	analyze:
	name: Analyze (${{ matrix.language }})
	runs-on: ubuntu-latest
	permissions:
	security-events: write # required to publish sarif

	strategy:
	fail-fast: false
	matrix:
	include:
	- language: actions
	build-mode: none
	- language: python
	build-mode: none
	- language: c-cpp
	build-mode: none
	- language: rust
	build-mode: none

	steps:
	- name: Harden the runner
	uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
	with:
	disable-sudo: true
	disable-telemetry: true
	egress-policy: block
	allowed-endpoints: >
	# Azure Wire Server IP
	168.63.129.16:80
	github.com:443
	index.crates.io:443
	release-assets.githubusercontent.com:443
	static.crates.io:443
	static.rust-lang.org:443

	- name: Checkout repository
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false

	# Initializes the CodeQL tools for scanning.
	- name: Initialize CodeQL
	uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
	with:
	languages: ${{ matrix.language }}
	build-mode: ${{ matrix.build-mode }}
	queries: security-extended

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
	with:
	category: "/language:${{matrix.language}}"

Navigation Menu