orca-cd/.github/workflows/codeql.yml at bf289a72a6f0d6ed3741d00a09fb2051efd69408 · OrcaCD/orca-cd · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
name: "CodeQL"

on:
  push:
    branches:
        - "main"
  pull_request:
  schedule:
    - cron: '42 4 * * 3' # Every Wednesday at 4:42am

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: 'ubuntu-latest'
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
        - language: actions
          build-mode: none
        - language: go
          build-mode: manual
        - language: javascript-typescript
          build-mode: none

    steps:
    - name: Checkout repository
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
          persist-credentials: false

    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      name: Set up Go
      if: matrix.build-mode == 'manual' && matrix.language == 'go'
      with:
        go-version: stable
        cache: true
        cache-dependency-path: backend/go.sum

    - name: Initialize CodeQL
      uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        queries: security-and-quality

    - name: Install Buf CLI
      uses: bufbuild/buf-action@fd21066df7214747548607aaa45548ba2b9bc1ff # v1.4.0
      if: matrix.build-mode == 'manual' && matrix.language == 'go'
      with:
        setup_only: true
        version: 1.66.1

    - name: Compile Protobufs
      working-directory: ./backend
      if: matrix.build-mode == 'manual' && matrix.language == 'go'
      run: |
        go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.11
        buf generate

    - name: Build Go code
      working-directory: ./backend
      if: matrix.build-mode == 'manual' && matrix.language == 'go'
      run: go build -o bin/hub ./cmd/hub && go build -o bin/agent ./cmd/agent
      env:
        CGO_ENABLED: 1

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
      with:
        category: "/language:${{matrix.language}}"