Attach OIDC Native to Ingress Resource #35034

	name: "CodeQL"

	on:
	push:
	branches:
	- main
	- release-*
	pull_request:
	# The branches below must be a subset of the branches above
	branches:
	- main
	merge_group:
	schedule:
	- cron: "36 6 * * 4" # run every Thursday at 06:36 UTC

	concurrency:
	group: ${{ github.ref_name }}-codeql
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	checks:
	name: Checks and variables
	if: github.repository == 'nginx/kubernetes-ingress'
	runs-on: ubuntu-24.04
	outputs:
	docs_only: ${{ github.event.pull_request && steps.docs.outputs.docs_only == 'true' }}
	steps:
	- name: Checkout Repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	fetch-depth: 0

	- name: Filter only docs changes
	id: docs
	run: \|
	files=$(git diff --name-only HEAD^ \| egrep -v "^examples/" \| egrep -v "^README.md")
	if [ -z "$files" ]; then
	echo "docs_only=true" >> $GITHUB_OUTPUT
	else
	echo "docs_only=false" >> $GITHUB_OUTPUT
	fi
	echo $files
	cat $GITHUB_OUTPUT
	shell: bash --noprofile --norc -o pipefail {0}

	analyze:
	if: github.repository == 'nginx/kubernetes-ingress' && (needs.checks.outputs.docs_only != 'true')
	needs: [checks]
	name: Analyze
	permissions:
	actions: read # for github/codeql-action/init to get workflow details
	contents: read # for actions/checkout to fetch code
	packages: read
	security-events: write # for github/codeql-action/autobuild to send a status report
	uses: nginx/compliance-rules/.github/workflows/sast.yml@eb7c8e7560d14e70266b934c32b7becaa3beeeed # v0.3.5
	with:
	requested_languages: go,python

Navigation Menu