dreamlayer/.github/workflows/codeql.yml at main · LetsGetToWorkBro/dreamlayer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
name: codeql

# GitHub's own semantic code analysis, complementing Semgrep (pattern rules) and
# gitleaks (secrets). CodeQL data-flow queries catch taint-style bugs — injection,
# unsafe deserialization, path traversal — across the two languages that carry the
# repo's trusted-input surface: Python (the Brain) and JS/TS (phone-app, web,
# registry-api). Results upload to Security → Code scanning (same place Semgrep and
# Scorecard already publish). Rust (reality-core) is covered by cargo-audit /
# cargo-deny; CodeQL's Rust support is still beta, so it is intentionally omitted.

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 7 * * 1"      # Mondays 07:00 UTC — catch newly-shipped queries

permissions:
  contents: read

jobs:
  analyze:
    name: analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write   # upload the CodeQL SARIF to code scanning
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        language: [python, javascript-typescript]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Initialize CodeQL
        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          # NOTE: the init input is `languages` (plural). Passing the singular
          # `language` is silently ignored, which makes CodeQL AUTO-DETECT every
          # language in the repo — including Ruby/Rust, whose extractors then hard-
          # fail ("could not process any code", exit 32). Pinning `languages` to the
          # one matrix language keeps each job to Python OR JS/TS only.
          languages: ${{ matrix.language }}
          # build-mode: none — Python and JS/TS are interpreted, so there is no
          # build to run (and autobuild is neither needed nor supported for them).
          build-mode: none
          # security-extended adds the higher-signal security queries on top of
          # the default set (more coverage, still curated for low false positives).
          queries: security-extended
          # One paths-ignore entry, for the Semgrep rule fixture — a file whose
          # PURPOSE is to contain the patterns a scanner should flag. The test
          # trees are NOT excluded and must not be: a hard-coded token in a test
          # file is a real alert here. Read the config's header before adding to
          # it; the entry is pinned by test_lockfile.py so a widening is not a
          # one-line diff that quietly stops analysing shipped code.
          config-file: .github/codeql/config.yml
      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          category: "/language:${{ matrix.language }}"