Skip to content

Commit 9b8fe65

Browse files
committed
Add CodeQL
1 parent 3c34cac commit 9b8fe65

File tree

1 file changed

+88
-0
lines changed

1 file changed

+88
-0
lines changed

.github/workflows/codeql.yml

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "trunk" ]
6+
pull_request:
7+
branches: [ "*" ]
8+
schedule:
9+
- cron: '33 23 * * 4'
10+
11+
jobs:
12+
analyze:
13+
name: Analyze (${{ matrix.language }})
14+
# Runner size impacts CodeQL analysis time. To learn more, please see:
15+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
16+
# - https://gh.io/supported-runners-and-hardware-resources
17+
# - https://gh.io/using-larger-runners (GitHub.com only)
18+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
19+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
20+
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
21+
permissions:
22+
# required for all workflows
23+
security-events: write
24+
25+
# required to fetch internal or private CodeQL packs
26+
packages: read
27+
28+
# only required for workflows in private repositories
29+
actions: read
30+
contents: read
31+
32+
strategy:
33+
fail-fast: false
34+
matrix:
35+
include:
36+
- language: java-kotlin
37+
build-mode: manual
38+
- language: ruby
39+
build-mode: none
40+
- language: swift
41+
build-mode: manual
42+
steps:
43+
- name: Checkout repository
44+
uses: actions/checkout@v4
45+
46+
- if: matrix.language == 'java-kotlin'
47+
uses: actions/setup-java@v4
48+
with:
49+
java-version: '17'
50+
distribution: corretto
51+
52+
- name: Install NDK
53+
if: matrix.language == 'java-kotlin'
54+
uses: nttld/setup-ndk@v1
55+
with:
56+
ndk-version: "r25b"
57+
link-to-sdk: true
58+
59+
# Initializes the CodeQL tools for scanning.
60+
- name: Initialize CodeQL
61+
uses: github/codeql-action/init@v3
62+
with:
63+
languages: ${{ matrix.language }}
64+
build-mode: ${{ matrix.build-mode }}
65+
# If you wish to specify custom queries, you can do so here or in a config file.
66+
# By default, queries listed here will override any specified in a config file.
67+
# Prefix the list here with "+" to use these queries and those in the config file.
68+
69+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
70+
# queries: security-extended,security-and-quality
71+
72+
- name: Prepare Kotlin Project
73+
if: matrix.language == 'java-kotlin'
74+
shell: bash
75+
run: |
76+
make setup-rust-android-targets
77+
cd native/kotlin
78+
./gradlew cargoBuild --info
79+
80+
- name: Prepare Swift Project
81+
if: matrix.language == 'swift'
82+
shell: bash
83+
run: make setup-rust xcframework
84+
85+
- name: Perform CodeQL Analysis
86+
uses: github/codeql-action/analyze@v3
87+
with:
88+
category: "/language:${{matrix.language}}"

0 commit comments

Comments
 (0)