Skip to content

CodeQL

CodeQL #505

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
name: "CodeQL"
on:
push:
branches: [ master ]
paths:
- '*.py'
pull_request:
branches: [ master ]
workflow_dispatch:
schedule:
- cron: '0 0 * * *'
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'python' ]
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
queries: +security-and-quality
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
# build:
# name: Build
# runs-on: ubuntu-20.04
# steps:
# - name: Checkout code
# uses: actions/checkout@v4
# - name: Build an image from Dockerfile
# run: docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
# - name: Run Trivy vulnerability scanner
# uses: aquasecurity/trivy-action@master
# with:
# image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
# format: 'sarif'
# output: 'trivy-results.sarif'
# - name: Upload Trivy scan results to GitHub Security tab
# uses: github/codeql-action/upload-sarif@v2
# with:
# sarif_file: 'trivy-results.sarif'