Drop swiftlint analyze from merge-gate's required jobs (deterministic… #128
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Static analysis via GitHub's CodeQL, separate from the lint/unit/acceptance | |
| # gates in ci.yml: this looks for security-relevant patterns (the query | |
| # packs), not style or correctness-by-test. Runs on push to main and on | |
| # every PR like ci.yml, plus a weekly schedule so newly-disclosed query-pack | |
| # findings surface even on a week with no code changes. | |
| # | |
| # Four languages, not one: GitHub's own code-scanning default-setup | |
| # auto-detection (repos/.../code-scanning/default-setup) reports this repo | |
| # as containing actions, c-cpp, python, and swift — scanning only swift, as | |
| # an earlier version of this workflow did, left the other three undetected, | |
| # which is what a "code scanning configuration error" surfaces as (the | |
| # advanced setup this workflow represents not covering everything GitHub's | |
| # own detection found). c-cpp is Sources/MutantKitSchemataRuntimeC (a real, | |
| # plain-C target the SwiftPM package builds); python is Scripts/ | |
| # compare-wave-reports.py; actions is this directory's own workflow YAML. | |
| # | |
| # Two jobs, not one: a first version tried to `init` all four languages | |
| # together under one `build-mode: manual` and failed outright -- | |
| # `codeql database init` rejects that combination with "GitHub Actions does | |
| # not support the manual build mode. Please try ... none." `build-mode` | |
| # applies to the whole init call, but swift/c-cpp (compiled, need a real | |
| # build to trace) and python/actions (scanned directly, no build step ever | |
| # applies) need different values, so they cannot share one job: | |
| # - analyze-compiled (macos-15, needs the real Xcode/Swift toolchain -- | |
| # CodeQL's Swift extractor only runs on macOS): languages: swift, c-cpp, | |
| # build-mode: manual. One `swift build` (the same invocation ci.yml's | |
| # `unit` job already trusts to build the whole package, including the C | |
| # target) traces both compiled languages at once -- `autobuild` was | |
| # rejected here for the same reason noted below. | |
| # - analyze-scanned (ubuntu-latest -- no compiler involved, so the | |
| # cheaper/faster Linux runner is strictly better, not just adequate): | |
| # languages: python, actions, no build-mode (these never build). | |
| # | |
| # `build-mode: manual` rather than `autobuild` on analyze-compiled: this is | |
| # a multi-target SwiftPM package with a plain-C target | |
| # (MutantKitSchemataRuntimeC) wrapped in a product with an explicit | |
| # `type: .static`, not a single generic executable — exactly the shape | |
| # autobuild's build-system heuristics are least reliable on. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| schedule: | |
| # Wednesday 13:00 UTC: an off-peak slot outside GitHub's own default | |
| # examples, chosen only to avoid piling onto the very top of the hour. | |
| - cron: "0 13 * * 3" | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze-compiled: | |
| name: Analyze (swift, c-cpp) | |
| runs-on: macos-15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Toolchain | |
| run: swift --version && xcodebuild -version | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: swift, c-cpp | |
| build-mode: manual | |
| - name: Build | |
| run: swift build | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v4 | |
| analyze-scanned: | |
| name: Analyze (python, actions) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: python, actions | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@v4 |