Skip to content

Commit 1ed4cf5

Browse files
jjngxjjngx
committed
add workflows
1 parent 58012da commit 1ed4cf5

File tree

2 files changed

+158
-0
lines changed

2 files changed

+158
-0
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
name: "CodeQL"
2+
3+
on:
4+
workflow_call:
5+
push:
6+
branches:
7+
- main
8+
- release-*
9+
pull_request:
10+
# The branches below must be a subset of the branches above
11+
branches:
12+
- main
13+
merge_group:
14+
schedule:
15+
- cron: "36 6 * * 4" # run every Thursday at 06:36 UTC
16+
17+
concurrency:
18+
group: ${{ github.ref_name }}-codeql
19+
cancel-in-progress: true
20+
21+
permissions:
22+
contents: read
23+
24+
jobs:
25+
checks:
26+
name: Checks and variables
27+
runs-on: ubuntu-22.04
28+
outputs:
29+
docs_only: ${{ github.event.pull_request && steps.docs.outputs.docs_only == 'true' }}
30+
steps:
31+
- name: Checkout Repository
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
with:
34+
fetch-depth: 0
35+
36+
#- name: Filter only docs changes
37+
# id: docs
38+
# run: |
39+
# files=$(git diff --name-only HEAD^ | egrep -v "^site/" | egrep -v "^examples/" | egrep -v "^README.md")
40+
# if [ -z "$files" ]; then
41+
# echo "docs_only=true" >> $GITHUB_OUTPUT
42+
# else
43+
# echo "docs_only=false" >> $GITHUB_OUTPUT
44+
# fi
45+
# echo $files
46+
# cat $GITHUB_OUTPUT
47+
# shell: bash --noprofile --norc -o pipefail {0}
48+
49+
analyze:
50+
if: ${{ needs.checks.outputs.docs_only != 'true' }}
51+
needs: [checks]
52+
permissions:
53+
actions: read # for github/codeql-action/init to get workflow details
54+
contents: read # for actions/checkout to fetch code
55+
security-events: write # for github/codeql-action/autobuild to send a status report
56+
name: Analyze
57+
runs-on: ubuntu-22.04
58+
59+
strategy:
60+
fail-fast: true
61+
# fail-fast: false
62+
matrix:
63+
language: ["go"]
64+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
65+
# Use only 'java' to analyze code written in Java, Kotlin or both
66+
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
67+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
68+
69+
steps:
70+
- name: Checkout repository
71+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
72+
73+
# Initializes the CodeQL tools for scanning.
74+
- name: Initialize CodeQL
75+
uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
76+
with:
77+
languages: ${{ matrix.language }}
78+
# If you wish to specify custom queries, you can do so here or in a config file.
79+
# By default, queries listed here will override any specified in a config file.
80+
# Prefix the list here with "+" to use these queries and those in the config file.
81+
82+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
83+
# queries: security-extended,security-and-quality
84+
85+
- name: Setup Golang Environment
86+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
87+
with:
88+
go-version-file: go.mod
89+
if: matrix.language == 'go'
90+
91+
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
92+
# If this step fails, then you should remove it and run the build manually (see below)
93+
- name: Autobuild
94+
uses: github/codeql-action/autobuild@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
95+
96+
# ℹ️ Command-line programs to run using the OS shell.
97+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
98+
99+
# If the Autobuild fails above, remove it and uncomment the following three lines.
100+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
101+
102+
# - run: |
103+
# echo "Run, Build Application using script"
104+
# ./location_of_script_within_repo/buildscript.sh
105+
106+
- name: Perform CodeQL Analysis
107+
uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
108+
with:
109+
category: "/language:${{matrix.language}}"

‎.github/workflows/mend.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Mend
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths-ignore:
8+
- site/**
9+
- examples/**
10+
workflow_dispatch:
11+
inputs:
12+
branch:
13+
type: string
14+
required: false
15+
default: main
16+
workflow_call:
17+
inputs:
18+
branch:
19+
type: string
20+
required: true
21+
22+
concurrency:
23+
group: ${{ github.ref_name }}-mend
24+
cancel-in-progress: true
25+
26+
permissions:
27+
contents: read
28+
29+
jobs:
30+
scan:
31+
name: Mend
32+
runs-on: ubuntu-22.04
33+
steps:
34+
- name: Checkout Repository
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
36+
with:
37+
ref: ${{ inputs.branch && inputs.branch || github.ref }}
38+
39+
- name: Download agent
40+
run: curl -fsSLJO https://github.com/whitesource/unified-agent-distribution/releases/latest/download/wss-unified-agent.jar
41+
42+
- name: Verify JAR
43+
run: jarsigner -verify wss-unified-agent.jar
44+
45+
- name: Scan and upload
46+
env:
47+
PRODUCT_NAME: nginx_tiger_demo_workflow${{ inputs.branch && inputs.branch || github.ref_name }}
48+
PROJECT_NAME: tiger_demo
49+
run: java -jar wss-unified-agent.jar -noConfig true -wss.url ${{ secrets.WSS_URL }} -apiKey ${{ secrets.WSS_NGINX_TIGER_TOKEN }} -product $PRODUCT_NAME -project $PROJECT_NAME -d .

0 commit comments

Comments
 (0)