зеркало из https://github.com/github/ruby.git
122 строки
4.3 KiB
YAML
122 строки
4.3 KiB
YAML
name: 'CodeQL'
|
|
|
|
on:
|
|
push:
|
|
branches: ['master']
|
|
paths-ignore:
|
|
- 'doc/**'
|
|
- '**/man/*'
|
|
- '**.md'
|
|
- '**.rdoc'
|
|
- '**/.document'
|
|
- '.*.yml'
|
|
pull_request:
|
|
paths-ignore:
|
|
- 'doc/**'
|
|
- '**/man/*'
|
|
- '**.md'
|
|
- '**.rdoc'
|
|
- '**/.document'
|
|
- '.*.yml'
|
|
schedule:
|
|
- cron: '0 12 * * *'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
|
|
cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
|
|
|
|
permissions: # added using https://github.com/step-security/secure-workflows
|
|
contents: read
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
actions: read # for github/codeql-action/init to get workflow details
|
|
contents: read # for actions/checkout to fetch code
|
|
security-events: write # for github/codeql-action/autobuild to send a status report
|
|
# CodeQL fails to run pull requests from dependabot due to missing write access to upload results.
|
|
if: >-
|
|
${{!(false
|
|
|| contains(github.event.head_commit.message, '[DOC]')
|
|
|| contains(github.event.head_commit.message, 'Document')
|
|
|| contains(github.event.pull_request.title, '[DOC]')
|
|
|| contains(github.event.pull_request.title, 'Document')
|
|
|| contains(github.event.pull_request.labels.*.name, 'Document')
|
|
|| (github.event_name == 'push' && github.event.pull_request.user.login == 'dependabot[bot]')
|
|
)}}
|
|
|
|
env:
|
|
enable_install_doc: no
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: cpp
|
|
- language: ruby
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
|
|
|
- name: Install libraries
|
|
if: ${{ contains(matrix.os, 'macos') }}
|
|
uses: ./.github/actions/setup/macos
|
|
|
|
- name: Install libraries
|
|
if : ${{ matrix.os == 'ubuntu-latest' }}
|
|
uses: ./.github/actions/setup/ubuntu
|
|
|
|
- uses: ./.github/actions/setup/directories
|
|
|
|
- name: Remove an obsolete rubygems vendored file
|
|
if: ${{ matrix.os == 'ubuntu-latest' }}
|
|
run: sudo rm /usr/lib/ruby/vendor_ruby/rubygems/defaults/operating_system.rb
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
|
|
- name: Autobuild
|
|
uses: github/codeql-action/autobuild@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
|
|
with:
|
|
category: '/language:${{ matrix.language }}'
|
|
upload: False
|
|
output: sarif-results
|
|
|
|
- name: filter-sarif
|
|
uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1
|
|
with:
|
|
patterns: |
|
|
+**/*.rb
|
|
-lib/uri/mailto.rb:rb/overly-large-range
|
|
-lib/uri/rfc3986_parser.rb:rb/overly-large-range
|
|
-lib/bundler/vendor/uri/lib/uri/mailto.rb:rb/overly-large-range
|
|
-lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb:rb/overly-large-range
|
|
-test/ruby/test_io.rb:rb/non-constant-kernel-open
|
|
-test/open-uri/test_open-uri.rb:rb/non-constant-kernel-open
|
|
-test/open-uri/test_ssl.rb:rb/non-constant-kernel-open
|
|
-spec/ruby/core/io/binread_spec.rb:rb/non-constant-kernel-open
|
|
-spec/ruby/core/io/readlines_spec.rb:rb/non-constant-kernel-open
|
|
-spec/ruby/core/io/foreach_spec.rb:rb/non-constant-kernel-open
|
|
-spec/ruby/core/io/write_spec.rb:rb/non-constant-kernel-open
|
|
-spec/ruby/core/io/read_spec.rb:rb/non-constant-kernel-open
|
|
-spec/ruby/core/kernel/open_spec.rb:rb/non-constant-kernel-open
|
|
input: sarif-results/${{ matrix.language }}.sarif
|
|
output: sarif-results/${{ matrix.language }}.sarif
|
|
if: ${{ matrix.language == 'ruby' }}
|
|
continue-on-error: true
|
|
|
|
- name: Upload SARIF
|
|
uses: github/codeql-action/upload-sarif@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
|
|
with:
|
|
sarif_file: sarif-results/${{ matrix.language }}.sarif
|
|
continue-on-error: true
|