| # Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. |
| # |
| # SPDX-License-Identifier: curl |
| |
| name: CodeQL |
| |
| on: |
| push: |
| branches: |
| - master |
| - '*/ci' |
| paths-ignore: |
| - '**/*.md' |
| - '.azure-pipelines.yml' |
| - '.circleci/**' |
| - '.cirrus.yml' |
| - 'appveyor.*' |
| - 'docs/**' |
| - 'packages/**' |
| - 'plan9/**' |
| - 'projects/**' |
| - 'tests/data/**' |
| - 'winbuild/**' |
| pull_request: |
| branches: |
| - master |
| paths-ignore: |
| - '**/*.md' |
| - '.azure-pipelines.yml' |
| - '.circleci/**' |
| - '.cirrus.yml' |
| - 'appveyor.*' |
| - 'docs/**' |
| - 'packages/**' |
| - 'plan9/**' |
| - 'projects/**' |
| - 'tests/data/**' |
| - 'winbuild/**' |
| schedule: |
| - cron: '0 0 * * 4' |
| |
| concurrency: |
| group: ${{ github.workflow }} |
| |
| permissions: {} |
| |
| jobs: |
| codeql: |
| runs-on: ubuntu-latest |
| permissions: |
| security-events: write |
| steps: |
| - name: Checkout repository |
| uses: actions/checkout@v4 |
| |
| # Initializes the CodeQL tools for scanning. |
| - name: Initialize CodeQL |
| uses: github/codeql-action/init@v3 |
| with: |
| languages: cpp |
| queries: security-extended |
| |
| # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). |
| # If this step fails, then you should remove it and run the build manually (see below) |
| - name: Autobuild |
| uses: github/codeql-action/autobuild@v3 |
| |
| # âšī¸ Command-line programs to run using the OS shell. |
| # đ https://git.io/JvXDl |
| |
| # âī¸ If the Autobuild fails above, remove it and uncomment the following three lines |
| # and modify them (or add more) to build your code if your project |
| # uses a compiled language |
| |
| # - run: | |
| # make bootstrap |
| # make release |
| |
| - name: Perform CodeQL Analysis |
| uses: github/codeql-action/analyze@v3 |