feat(remote): one entry per release, and one per person #1906
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "34 7 * * 4" | |
| concurrency: | |
| group: codeql-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| changes: | |
| name: Detect changes | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| rust: ${{ steps.filter.outputs.rust }} | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v3.0.2 | |
| id: filter | |
| with: | |
| filters: | | |
| rust: | |
| - 'src-tauri/**' | |
| - '**/*.rs' | |
| - '**/Cargo.toml' | |
| - '**/Cargo.lock' | |
| analyze-js: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [javascript-typescript, actions] | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| - uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: none | |
| queries: security-extended | |
| config: | | |
| paths-ignore: | |
| - 'dist/**' | |
| - 'node_modules/**' | |
| - 'src-tauri/target/**' | |
| - 'src-tauri/**' | |
| - 'bun.lock' | |
| - '**/*.config.ts' | |
| - '**/*.config.js' | |
| - '**/*.config.mjs' | |
| - '**/*.config.cjs' | |
| - uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| analyze-rust: | |
| name: Analyze (rust) | |
| needs: changes | |
| if: github.event_name != 'pull_request' || needs.changes.outputs.rust == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| # CodeQL needs a real build to resolve call targets / types through | |
| # proc macros (#[tauri::command], sqlx::query!, etc.) and external | |
| # crate symbols. Without it, analysis quality drops below the 50 % | |
| # call-target threshold and GitHub flags the run as low-quality. | |
| # Installed directly rather than via cache-apt-pkgs-action: the | |
| # runner image's pre-baked apt index pins package versions the | |
| # Ubuntu mirror rotates out, so a cached install with no `apt-get | |
| # update` 404s, and the action's package-list-keyed cache saves an | |
| # empty entry on failure that poisons later runs. Same rationale as | |
| # ci.yml. | |
| - name: Install Linux build dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| libgtk-3-dev libwebkit2gtk-4.1-dev libsoup-3.0-dev \ | |
| libayatana-appindicator3-dev librsvg2-dev libasound2-dev \ | |
| libssl-dev pkg-config | |
| - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable | |
| with: | |
| toolchain: 1.98.0 | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| with: | |
| workspaces: src-tauri | |
| # Pre-fetch the full dep graph so CodeQL's internal `cargo metadata` | |
| # invocations resolve every transitive crate without hitting the | |
| # registry mid-extraction. The Rust extractor is preview-only and | |
| # rejects build-mode=manual, so this is the main lever we have to | |
| # push call-target resolution above the 50 % threshold. | |
| - name: cargo fetch | |
| run: cargo fetch --manifest-path src-tauri/Cargo.toml --locked | |
| - uses: github/codeql-action/init@v4 | |
| with: | |
| languages: rust | |
| build-mode: none | |
| queries: security-extended | |
| config: | | |
| paths-ignore: | |
| # Vendored glib 0.18.5 with RUSTSEC-2024-0429 backported | |
| # (see src-tauri/vendor/glib-0.18.5/PATCHES.md). We don't | |
| # review third-party upstream through CodeQL, and Rust | |
| # unsafe blocks raise large amounts of false positives. | |
| - 'src-tauri/vendor/**' | |
| - 'src-tauri/target/**' | |
| - uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:rust" | |
| analyze-rust-skip: | |
| name: Analyze (rust) | |
| needs: changes | |
| if: github.event_name == 'pull_request' && needs.changes.outputs.rust != 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - name: Create empty SARIF | |
| run: | | |
| cat > empty.sarif <<'EOF' | |
| { | |
| "version": "2.1.0", | |
| "$schema": "https://json.schemastore.org/sarif-2.1.0.json", | |
| "runs": [ | |
| { | |
| "tool": { "driver": { "name": "CodeQL", "rules": [] } }, | |
| "results": [] | |
| } | |
| ] | |
| } | |
| EOF | |
| - uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: empty.sarif | |
| category: "/language:rust" |