diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 253750a..87e3d31 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -9,9 +9,16 @@ on: # pull_request: # branches: [ "main", "master" ] schedule: - - cron: "17 6 * * *" # Randomized per repository, daily runs somewhere between 22:00 and 06:00 UTC + - cron: '17 6 * * *' # Randomized per repository, daily runs somewhere between 22:00 and 06:00 UTC workflow_dispatch: +env: + ARTIFACTORY_PASSWORD: ${{ secrets.EE_ARTIFACTORY_PASSWORD }} + ARTIFACTORY_URL: ${{ secrets.EE_ARTIFACTORY_URL }} + ARTIFACTORY_USERNAME: ${{ secrets.EE_ARTIFACTORY_USERNAME }} + VAULT_ROLE_ID: ${{ secrets.VAULT_ROLE_ID }} + VAULT_SECRET_ID: ${{ secrets.VAULT_SECRET_ID }} + jobs: analyze: name: Analyze @@ -22,24 +29,38 @@ jobs: security-events: write packages: read + strategy: + fail-fast: false + matrix: + include: + - language: actions + build-mode: none + - language: go + build-mode: manual # For languages that require build, teams must specify the container in which CodeQL will run; if language does not require build this section is removed by automation + container: + image: 'IMAGE_PLACEHOLDER' # Teams should adapt, should be in the format 'eu.gcr.io/halfpipe-io/build-image' + steps: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-go@v6 - with: - go-version: "1.23" + + - name: Initialize CodeQL uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 with: - languages: go - build-mode: manual + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} - name: Build app - run: go build ./... + if: matrix.build-mode == 'manual' + shell: bash + run: | + 'BUILD_COMMAND_PLACEHOLDER' + # Teams must specify the build command for their application; if language does not require build this step is removed by automation - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6 with: - category: "/language:go" - threads: 2 + category: "/language:${{matrix.language}}" + threads: 2 \ No newline at end of file