Emeka edit #743
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL and Dependency Review" | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "0 0 * * 0" | |
| jobs: | |
| dependency-review: | |
| # actions/dependency-review-action diffs dependency changes between a | |
| # base ref and a head ref, which only exist in a pull_request context. | |
| # On a push/schedule trigger there is nothing to diff against, and the | |
| # action hard-fails with "Both a base ref and head ref must be | |
| # provided" rather than passing trivially — so skip it outside of PRs | |
| # instead of failing every push to main. | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| # actions/dependency-review-action also requires the GitHub | |
| # "Dependency graph" repository feature to be enabled | |
| # (Settings > Code security > Dependency graph). It reports as | |
| # disabled for this repo (confirmed via | |
| # GET /repos/{owner}/{repo}/dependency-graph/sbom -> 404, and | |
| # security_and_analysis has no dependency_graph field to toggle it | |
| # through the API) and is not something repo-admin access can turn | |
| # on — it appears to be restricted at the org/enterprise level. Made | |
| # non-blocking rather than failing every PR on a platform capability | |
| # we have no way to enable. | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |
| continue-on-error: true | |
| with: | |
| fail-on-severity: high | |
| fail-on-scopes: runtime | |
| analyze: | |
| name: Analyze | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ["typescript"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 |