Repository navigation
chore(deps): Bump the npm-minor-and-patch group across 1 directory with 49 updates #195
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: '17 3 * * 1' | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| # Language matrix is path-gated on pull_request so a docs/i18n-only change does not spin up | |
| # macos Swift builds or other native SDK scanners. push to main, weekly schedule, and manual | |
| # dispatch still analyze every configured language. | |
| # | |
| # Important: job-level `if` with `needs` cannot use the `matrix` context. The detect job therefore | |
| # emits the concrete matrix JSON and analyze consumes it with fromJSON. | |
| jobs: | |
| changes: | |
| name: Detect languages | |
| if: github.event.repository.visibility == 'public' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| outputs: | |
| matrix: ${{ steps.select.outputs.matrix }} | |
| has_work: ${{ steps.select.outputs.has_work }} | |
| steps: | |
| # actions/checkout v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Select languages to analyze | |
| id: select | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| # language|build_mode|runner | |
| all_rows=( | |
| 'actions|none|ubuntu-latest' | |
| 'javascript-typescript|none|ubuntu-latest' | |
| 'go|autobuild|ubuntu-latest' | |
| 'python|none|ubuntu-latest' | |
| 'ruby|none|ubuntu-latest' | |
| 'java-kotlin|none|ubuntu-latest' | |
| 'csharp|none|ubuntu-latest' | |
| 'swift|manual|macos-latest' | |
| ) | |
| selected=() | |
| append_row() { | |
| local row="$1" | |
| selected+=("$row") | |
| } | |
| append_all() { | |
| local row | |
| for row in "${all_rows[@]}"; do | |
| append_row "$row" | |
| done | |
| } | |
| # Full matrix outside pull requests (main, schedule, workflow_dispatch). | |
| if [[ "${{ github.event_name }}" != 'pull_request' ]]; then | |
| append_all | |
| else | |
| # PRs always scan workflow YAML and the TypeScript/JavaScript surface. | |
| append_row 'actions|none|ubuntu-latest' | |
| append_row 'javascript-typescript|none|ubuntu-latest' | |
| base='${{ github.event.pull_request.base.sha }}' | |
| head='${{ github.event.pull_request.head.sha }}' | |
| mapfile -t files < <(git diff --name-only "$base" "$head") | |
| match() { | |
| local re="$1" | |
| local f | |
| for f in "${files[@]}"; do | |
| if [[ "$f" =~ $re ]]; then | |
| return 0 | |
| fi | |
| done | |
| return 1 | |
| } | |
| if match '^sdk/go/'; then | |
| append_row 'go|autobuild|ubuntu-latest' | |
| fi | |
| if match '^sdk/python/'; then | |
| append_row 'python|none|ubuntu-latest' | |
| fi | |
| if match '^sdk/ruby/'; then | |
| append_row 'ruby|none|ubuntu-latest' | |
| fi | |
| if match '^sdk/(java|android)/'; then | |
| append_row 'java-kotlin|none|ubuntu-latest' | |
| fi | |
| if match '^sdk/(dotnet|windows)/'; then | |
| append_row 'csharp|none|ubuntu-latest' | |
| fi | |
| if match '^sdk/(ios|macos)/'; then | |
| append_row 'swift|manual|macos-latest' | |
| fi | |
| fi | |
| if [[ ${#selected[@]} -eq 0 ]]; then | |
| echo 'has_work=false' >> "$GITHUB_OUTPUT" | |
| echo 'matrix={"include":[]}' >> "$GITHUB_OUTPUT" | |
| echo 'No CodeQL languages selected.' | |
| exit 0 | |
| fi | |
| include_json='[' | |
| first=1 | |
| for row in "${selected[@]}"; do | |
| IFS='|' read -r language build_mode runner <<<"$row" | |
| if [[ $first -eq 0 ]]; then | |
| include_json+=',' | |
| fi | |
| first=0 | |
| include_json+=$(printf '{"language":"%s","build_mode":"%s","runner":"%s"}' \ | |
| "$language" "$build_mode" "$runner") | |
| done | |
| include_json+=']' | |
| matrix_json=$(printf '{"include":%s}' "$include_json") | |
| { | |
| echo "has_work=true" | |
| echo "matrix=$matrix_json" | |
| } >> "$GITHUB_OUTPUT" | |
| echo "Selected CodeQL matrix: $matrix_json" | |
| analyze: | |
| name: Analyze ${{ matrix.language }} | |
| needs: changes | |
| if: | | |
| github.event.repository.visibility == 'public' && | |
| needs.changes.outputs.has_work == 'true' | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJSON(needs.changes.outputs.matrix) }} | |
| steps: | |
| # actions/checkout v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build_mode }} | |
| - name: Build Swift packages | |
| if: matrix.language == 'swift' | |
| run: | | |
| swift build --package-path sdk/ios | |
| swift build --package-path sdk/macos | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 | |
| with: | |
| category: /language:${{ matrix.language }} |