docs: workflow customization guide (#2368) #1219
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL" | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| schedule: | |
| # Weekly scan on Sunday at 1:00 UTC (after security.yml at 0:00) | |
| - cron: "0 1 * * 0" | |
| workflow_dispatch: | |
| # Allow manual trigger | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: | |
| - javascript-typescript | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # Use default queries plus security-extended | |
| queries: security-extended,security-and-quality | |
| # Use custom config to handle SPARQL 1.1 spec-required patterns | |
| config-file: ./.github/codeql/codeql-config.yml | |
| # Note: For JavaScript/TypeScript, CodeQL can analyze source directly | |
| # without autobuild. Skipping autobuild prevents analysis of generated | |
| # bundled files (main.js) which contain third-party library code. | |
| - name: Perform CodeQL Analysis | |
| id: analyze | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| # Disable auto-upload so we can filter first | |
| upload: false | |
| # Output SARIF file for post-processing | |
| output: sarif-results | |
| # Filter out known false positives before uploading: | |
| # - BuiltInFunctions.ts: MD5/SHA1 and RAND() usage in SPARQL is required by W3C spec | |
| # - FilterExecutor.ts: Calls RAND() function - same SPARQL 1.1 spec compliance | |
| # - main.js: Bundled file with minified third-party code (reflect-metadata, etc.) | |
| # Alerts from main.js are filtered because the bundled output includes polyfills | |
| # and minified library code where patterns like unreachable statements, hoisted | |
| # var declarations, trivial conditionals, and unneeded defensive code are valid | |
| # optimization artifacts from esbuild's CommonJS/ESM interop helpers | |
| # Filter out known false positives before uploading. | |
| # Test files: TypeScript decorators (@inject) are stripped in compiled JS, | |
| # making constructor calls appear to have "superfluous" arguments when | |
| # tests pass mock dependencies directly - this is valid DI testing pattern. | |
| - name: Filter SARIF for known false positives | |
| uses: advanced-security/filter-sarif@v1 | |
| with: | |
| patterns: | | |
| -**/BuiltInFunctions.ts:js/weak-cryptographic-algorithm | |
| -**/BuiltInFunctions.ts:js/insecure-randomness | |
| -**/FilterExecutor.ts:js/insecure-randomness | |
| -**/main.js:js/useless-expression | |
| -**/main.js:js/automatic-semicolon-insertion | |
| -**/main.js:js/trivial-conditional | |
| -**/main.js:js/use-before-declaration | |
| -**/main.js:js/unreachable-statement | |
| -**/main.js:js/redundant-operation | |
| -**/main.js:js/unneeded-defensive-code | |
| -**/main.js:js/useless-assignment-to-local | |
| -**/main.js:js/unused-local-variable | |
| -**/main.js:js/comparison-between-incompatible-types | |
| -**/*.test.ts:js/superfluous-trailing-arguments | |
| -**/*.test.ts:js/unused-local-variable | |
| -**/*.test.tsx:js/unused-local-variable | |
| -**/tests/**:js/unused-local-variable | |
| -**/specs/**:js/unused-local-variable | |
| -**/specs/**:js/comparison-between-incompatible-types | |
| -scripts/*:js/unused-local-variable | |
| input: ${{ steps.analyze.outputs.sarif-output }}/javascript.sarif | |
| output: ${{ steps.analyze.outputs.sarif-output }}/javascript.sarif | |
| - name: Upload filtered SARIF | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: ${{ steps.analyze.outputs.sarif-output }} | |
| category: "/language:${{ matrix.language }}" |