Change development environment setup repository URL #94
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================== | |
| # File: .github/workflows/codeql.yml | |
| # Project: Apotropaios - Firewall Manager (Python Variant) | |
| # Synopsis: CodeQL semantic code analysis pipeline | |
| # Description: Runs GitHub CodeQL security analysis for Python on every push | |
| # to main, pull requests targeting main, and a weekly schedule. | |
| # Results publish to the repository Security tab. | |
| # Notes: - security-events write permission is required for upload | |
| # - Code scanning must be ENABLED in the repository settings | |
| # (Settings > Code security > Code scanning) or the upload | |
| # step fails with "Code scanning is not enabled for this | |
| # repository" even though analysis itself succeeds; the | |
| # SARIF artifact below preserves results regardless | |
| # - If the repository has code-scanning DEFAULT SETUP enabled | |
| # instead, this advanced workflow's uploads are rejected; | |
| # use exactly one of the two modes | |
| # - CodeQL Action v4 (Node.js 24 runtime); v3 enters deprecation | |
| # December 2026 | |
| # - Action pins follow the project standard: checkout@v6, | |
| # setup-python@v6 | |
| # Version: 1.6.2 | |
| # ============================================================================== | |
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "31 5 * * 1" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ============================================================================ | |
| # CodeQL Analysis (Python) | |
| # ============================================================================ | |
| analyze: | |
| name: Analyze (python) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: python | |
| build-mode: none | |
| queries: security-and-quality | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:python" | |
| output: sarif-results | |
| - name: Preserve SARIF results as artifact | |
| # Runs even when the code-scanning upload fails (feature disabled), | |
| # so analysis results remain accessible from the run page | |
| if: always() | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: codeql-sarif | |
| path: sarif-results | |
| retention-days: 30 |