Apex-CodeGenesis/.github/workflows/codeql.yml at main · justinlietz93/Apex-CodeGenesis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
name: "CodeQL Daily"

on:
    push:
        branches: ["main"]
    pull_request:
        branches: ["main"]
    schedule:
        - cron: "0 0 * * *" # Daily scan at 00:00 UTC

jobs:
    analyze:
        name: Analyze (${{ matrix.language }})
        runs-on: ${{ matrix.language == 'swift' && 'macos-latest' || 'ubuntu-latest' }}
        permissions:
            security-events: write
            packages: read
            actions: read
            contents: read

        strategy:
            fail-fast: false
            matrix:
                include:
                    - language: actions
                      build-mode: none
                    - language: javascript-typescript
                      build-mode: none
                    - language: python
                      build-mode: none
                # Other supported languages: c-cpp, csharp, go, java-kotlin, ruby, swift

        steps:
            - name: Checkout repository
              uses: actions/checkout@v4

            # ───── Optional: install runtimes or compilers ──────────────────────────────
            # - name: Setup Node.js
            #   uses: actions/setup-node@v3
            #   with: node-version: '18'
            # - name: npm ci & build
            #   run: |
            #     npm ci
            #     npm run build

            - name: Initialize CodeQL
              uses: github/codeql-action/init@v3
              with:
                  languages: ${{ matrix.language }}
                  build-mode: ${{ matrix.build-mode }}
                  # To add extra query packs:
                  # queries: "+security-extended,security-and-quality"

            - name: Manual build (if needed)
              if: ${{ matrix.build-mode == 'manual' }}
              shell: bash
              run: |
                  echo "Manual build mode – replace this with your actual build commands"
                  exit 1

            - name: Perform CodeQL analysis
              uses: github/codeql-action/analyze@v3
              with:
                  category: "/language:${{ matrix.language }}"