fix(security): harden workflows and stabilize Pester CI #74
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security - CodeQL Analysis | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| schedule: | |
| # Run weekly on Mondays at 2 AM UTC | |
| - cron: '0 2 * * 1' | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| issues: write | |
| security-events: write | |
| pull-requests: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'actions' ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| - name: Perform CodeQL Analysis | |
| id: analyze | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| upload: true | |
| - name: Comment PR with CodeQL Results | |
| if: github.event_name == 'pull_request' && steps.analyze.outcome == 'success' | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| const body = `🔍 **CodeQL Analysis Complete** (${{ matrix.language }}) | |
| CodeQL analysis has completed successfully. Results are available in the **Security** tab of this PR. | |
| **Language Analyzed:** ${{ matrix.language }} | |
| **Query Suite:** security-extended, security-and-quality | |
| 📋 **View Results:** | |
| - Check the Security tab above for detailed findings | |
| - Review any alerts and address them before merging | |
| > **Note:** CodeQL does not natively support PowerShell. This analysis covers GitHub Actions workflows in \`.github/workflows\`. | |
| *Analysis performed automatically by CodeQL*`; | |
| github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: body | |
| }); | |
| - name: Comment PR with CodeQL Errors | |
| if: github.event_name == 'pull_request' && steps.analyze.outcome == 'failure' | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| const body = `❌ **CodeQL Analysis Failed** (${{ matrix.language }}) | |
| CodeQL analysis encountered an error. Please check the workflow logs for details. | |
| **Language:** ${{ matrix.language }} | |
| *Check the workflow run for error details.*`; | |
| github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: body | |
| }); |