docs(sequester): Add more details to steps #25860
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| # The branches below must be a subset of the branches above | |
| branches: | |
| - master | |
| schedule: | |
| # Every Wednesday at 04:20 | |
| - cron: 20 4 * * 3 | |
| # We set `concurrency` to prevent having this workflow being run on code that is not up-to-date on a PR (a user make multiple push in a quick manner). | |
| # But on the main branch, we don't want that behavior. | |
| # Having the workflow run on each merge commit is something we would like, that could help us where a regression was made and missed by previous checks. | |
| # | |
| # For that we use `head_ref` that is only defined on `pull-request` and fallback to `run_id` (this is a counter, so it's value is unique between workflow call). | |
| concurrency: | |
| group: codeql-${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: read # Needed by `dorny/paths-filter` action | |
| jobs: | |
| python-analyze: | |
| name: 🐍 Python static code Analysis | |
| runs-on: ubuntu-24.04 | |
| env: | |
| poetry-version: 2.2.1 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin v7.0.0 | |
| timeout-minutes: 5 | |
| - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # pin v4.0.2 | |
| id: changes | |
| with: | |
| filters: .github/filters/codeql.yml | |
| - name: Check modified path that require `python-analysis` to run | |
| id: should-run-python-analysis | |
| # We want the job to run when: | |
| # - modifying python code | |
| # - in the merge queue | |
| # - on the main branch | |
| if: >- | |
| steps.changes.outputs.python-analyze == 'true' | |
| || contains(github.ref, 'gh-readonly-queue') | |
| || github.ref == 'refs/heads/master' | |
| run: echo "run=true" >> $GITHUB_OUTPUT | |
| shell: bash | |
| # Initializes the CodeQL tools for scanning. | |
| - name: Initialize CodeQL | |
| if: steps.should-run-python-analysis.outputs.run == 'true' | |
| uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # pin v4.36.3 | |
| with: | |
| languages: python | |
| setup-python-dependencies: false | |
| # If you wish to specify custom queries, you can do so here or in a config file. | |
| # By default, queries listed here will override any specified in a config file. | |
| # Prefix the list here with "+" to use these queries and those in the config file. | |
| # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs | |
| # queries: security-extended,security-and-quality | |
| - uses: ./.github/actions/setup-python-poetry | |
| if: steps.should-run-python-analysis.outputs.run == 'true' | |
| id: setup-python | |
| with: | |
| poetry-version: ${{ env.poetry-version }} | |
| project-path: ./server | |
| - name: Install python deps | |
| if: steps.should-run-python-analysis.outputs.run == 'true' | |
| run: | | |
| poetry install | |
| poetry run sh -c 'echo "CODEQL_PYTHON=$(which python)"' >> $GITHUB_ENV | |
| working-directory: server | |
| env: | |
| POETRY_LIBPARSEC_BUILD_STRATEGY: no_build | |
| - name: Perform CodeQL Analysis | |
| if: steps.should-run-python-analysis.outputs.run == 'true' | |
| uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # pin v4.36.3 | |
| with: | |
| category: /language:python | |
| javascript-analyze: | |
| name: 🌐 Javascript static code Analysis | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # pin v7.0.0 | |
| timeout-minutes: 5 | |
| - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # pin v4.0.2 | |
| id: changes | |
| with: | |
| filters: .github/filters/codeql.yml | |
| - name: Check modified path that require `javascript-analysis` to run | |
| id: should-run-js-analysis | |
| if: >- | |
| steps.changes.outputs.js-analyze == 'true' | |
| || contains(github.ref, 'gh-readonly-queue') | |
| || github.ref == 'refs/heads/master' | |
| run: echo "run=true" >> $GITHUB_OUTPUT | |
| shell: bash | |
| # Initializes the CodeQL tools for scanning. | |
| - name: Initialize CodeQL | |
| if: steps.should-run-js-analysis.outputs.run == 'true' | |
| uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # pin v4.36.3 | |
| with: | |
| languages: typescript | |
| - name: Install dependencies for ionic project | |
| if: steps.should-run-js-analysis.outputs.run == 'true' | |
| run: npm clean-install | |
| working-directory: client | |
| - name: Autobuild for typescript | |
| if: steps.should-run-js-analysis.outputs.run == 'true' | |
| uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # pin v4.36.3 | |
| with: | |
| working-directory: client | |
| - name: Perform CodeQL Analysis | |
| if: steps.should-run-js-analysis.outputs.run == 'true' | |
| uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # pin v4.36.3 | |
| with: | |
| category: /language:typescript |