UniStack/.github/workflows/codeql.yml at main · snowdreamtech/UniStack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# Copyright (c) 2026 SnowdreamTech. All rights reserved.
# Licensed under the MIT License. See LICENSE file in the project root for full license information.

---
# CodeQL Security Analysis
# Purpose: Performs deep static analysis to detect security vulnerabilities and coding errors.
# Trigger: Push to main, weekly schedule, and manual dispatch.
# Permissions:
#   - security-events: write (Required to upload SARIF results to the GitHub Security tab).
#   - actions: read (Required to determine workflow run status).
#   - contents: read (Required for code analysis).
# Concurrency:
#   - group: ${{ github.workflow }}-${{ github.ref }} (Ensures only the latest scan results are processed).
#   - cancel-in-progress: true (In-progress scans are superseded by newer commits to save resources).
# Design:
#   - Utilizes advanced matrix strategy for multi-language support (Go, Python).
#   - Leverages internal CodeQL autobuild for zero-config compilation where possible.

name: "🔬 CodeQL Analysis"

"on":
  push:
    branches:
      - "main"
      - "dev"
  pull_request:
    branches:
      - "main"
      - "dev"
      - "feat/**"
      - "branch/**"
      - "feature/**"
      - "fix/**"
      - "pr/**"

permissions: {}

env:
  UNIRTM_LOCKED: 1

jobs:
  analyze:
    name: "🛡️ Deep Semantic Analysis (${{ matrix.language }})"
    runs-on: ubuntu-latest
    concurrency:
      group: codeql-${{ github.workflow }}-${{ matrix.language }}-${{ github.ref }}
      cancel-in-progress: true
    permissions:
      security-events: write # Required to upload SARIF results to the GitHub Security tab
      actions: read # Required to determine workflow run status
      contents: read # Required for code analysis
    timeout-minutes: 360 # Deep scans on large repos can take significant time

    strategy:
      fail-fast: false
      matrix:
        language:
          - actions
          - go
          # - python                # Python (*.py) — ruff, ansible-lint
          # - javascript-typescript # JS/TS (*.js, *.ts, *.jsx, *.tsx) — eslint
          # - c-cpp                 # C/C++/Obj-C (*.c, *.cpp, *.h) — clang-format
          # - csharp                # C# (*.cs) — dotnet format
          # - java-kotlin           # Java/Kotlin (*.java, *.kt) — ktlint
          # - ruby                  # Ruby (*.rb) — rubocop
          # - swift                 # Swift (*.swift) — swiftformat, swiftlint

    steps:
      - name: "📂 Checkout Repository Code"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "🛡️ Initialize CodeQL Engine"
        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          # Sets up the CodeQL database for the specified technical stack (e.g., Python, Go).
          languages: ${{ matrix.language }}
          config-file: .github/codeql/codeql-config.yml

      - name: "🚀 Bootstrap Target Build"
        uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        # Attempts to automatically compile the project to enable full-trace analysis.

      - name: "🔍 Perform Deep Security Analysis"
        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          # Executes the semantic queries and generates the final vulnerability report.
          category: "/language:${{ matrix.language }}"