hiero-sdk-python/.github/workflows/pr-check-primary-codeql.yml at main · aceppaluni/hiero-sdk-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
name: "CodeQL Advanced"

on:
    push:
        branches: ["main"]
    pull_request:
        branches: ["main"]
        paths-ignore:
            - "**/*.md"
    schedule:
        - cron: "28 23 * * *" # Runs every day at 23:28 UTC.

permissions:
  contents: read

jobs:
    analyze:
        name: Analyze (${{ matrix.language }})
        runs-on: hl-sdk-py-lin-md
        permissions:
            contents: read
            # required for all workflows
            security-events: write
            # required to fetch internal or private CodeQL packs
            packages: read

        strategy:
            fail-fast: false
            matrix:
                include:
                    - language: actions
                      build-mode: none
                    - language: python
                      build-mode: none
        steps:
            - name: Checkout repository
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

            - name: Harden the runner (Audit all outbound calls)
              uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
              with:
                  egress-policy: audit

            - name: Initialize CodeQL
              uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
              with:
                  languages: ${{ matrix.language }}
                  build-mode: ${{ matrix.build-mode }}
                  queries: security-extended
                  dependency-caching: true

            - name: Set up Python
              if: matrix.language == 'python'
              uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
              with:
                  python-version: "3.13"

            - name: Install uv
              if: matrix.language == 'python'
              uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
              with:
                  enable-cache: true

            - name: Install dependencies
              if: matrix.language == 'python'
              run: uv sync --frozen --all-groups --all-packages --all-extras

            - name: Perform CodeQL Analysis
              uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
              with:
                  category: "/language:${{matrix.language}}"