docs: link web flasher from quickstart #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: AGPL-3.0-only | |
| # Copyright (C) 2026 RS-Key contributors | |
| # CodeQL static analysis, on pull requests. | |
| # | |
| # The merge gate already runs `cargo clippy -D warnings` and gitleaks, and | |
| # neither is SAST: clippy is a per-crate lint and gitleaks matches secrets, so | |
| # neither does the cross-procedure dataflow CodeQL is here for. Nothing in the | |
| # tree did, which is why OpenSSF Scorecard's SAST check scored this repo 0/10 — | |
| # a number a downstream consumer reads as "runs no static analysis at all". | |
| # | |
| # `build-mode: none` because `firmware/` does not build on a host runner at | |
| # all: it is `no_std` embassy-rp for `thumbv8m.main-none-eabihf` (AGENTS.md, | |
| # "Build & test"). Buildless analysis reads the sources rather than a | |
| # compilation, so the crates, the firmware glue and the Python host tooling are | |
| # all covered without a cross-compile toolchain here. | |
| # | |
| # Deliberately no `push:` and no `schedule:` — this reports on the change under | |
| # review and nothing else. It is advisory, not a merge gate; `check.sh` is the | |
| # gate (docs/testing.md, "CI parity"). The cost is real: with no default-branch | |
| # run, code scanning holds no baseline, so findings surface on the pull request | |
| # rather than in the repository's security tab. | |
| # | |
| # No `paths-ignore` either, which looks like a saving and is not: Scorecard | |
| # scores SAST over the commits whose pull request carried an analysis, so a | |
| # path-filtered PR is one that counts against it — the same shape as the | |
| # `paths:`-versus-job-`if:` trap ci.yml's header describes. | |
| name: codeql | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| # Deny by default at the workflow level; the job below grants exactly the two | |
| # scopes CodeQL needs. `actions: read` is not one of them — code scanning only | |
| # requires that on a private or internal repository. | |
| permissions: {} | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| strategy: | |
| fail-fast: false # one language failing must not hide the other's result | |
| matrix: | |
| language: [rust, python] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read # checkout | |
| security-events: write # upload the SARIF to code scanning | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: none | |
| # Extraction-time `paths-ignore`. NOT the workflow-level `paths-ignore` | |
| # this file's header refuses: that one skips the run, which Scorecard | |
| # counts against the SAST score; this one still runs and still counts. | |
| config-file: ./.github/codeql/codeql-config.yml | |
| # The automation id Code Scanning matches analyses on. Left unset it is | |
| # derived from the workflow path, the job name and the matrix, so renaming | |
| # any of the three reads as a new analysis rather than a newer one. | |
| - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| category: /language:${{ matrix.language }} |