🌱 Add GitHub workflow to scan project with CodeQL #1
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL Advanced" | |
| on: | |
| # We are checking master and book-v4 because book-v4 has always the code | |
| # from the latest release | |
| push: | |
| branches: ["master", "book-v4"] | |
| pull_request: | |
| branches: ["master", "book-v4"] | |
| schedule: | |
| - cron: '30 20 * * 1' # Runs a periodic scan every Monday at 8:30 PM | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: go | |
| build-mode: autobuild | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # Set up Go environment for Kubebuilder projects | |
| - name: Setup Go | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: '1.22' | |
| # Install Kubebuilder tools, specifically Kustomize v5.5.0 and controller-gen | |
| - name: Install Kubebuilder tools | |
| run: | | |
| go install sigs.k8s.io/controller-tools/cmd/[email protected] | |
| go install sigs.k8s.io/kustomize/kustomize/[email protected] | |
| # Run `make install` to install Kubebuilder CLI | |
| - name: Build and install Kubebuilder CLI | |
| run: make install | |
| # Build and prepare resources in each sample project under testdata | |
| - name: Build sample projects in testdata | |
| run: | | |
| for dir in testdata/*; do | |
| if [ -d "$dir" ]; then | |
| (cd "$dir" && make all) | |
| fi | |
| done | |
| # Initialize CodeQL analysis for the specified languages | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| # Manual build mode for Go in generated projects only, if autobuild is insufficient | |
| - if: matrix.language == 'go' && matrix.build-mode == 'manual' | |
| shell: bash | |
| run: | | |
| for dir in testdata/*; do | |
| if [ -d "$dir" ]; then | |
| (cd "$dir" && echo 'Running manual build commands for Go in sample project' && make manifests && make build) | |
| fi | |
| done | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{matrix.language}}" |