mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-26 06:43:15 +08:00
Martin Vogel
a030a831df
Dependabot opened one PR per sub-action (#2363 init, #2365 analyze, #2364 upload-sarif). CodeQL refuses a split pin: with init at 4.38.1 and analyze at 4.38.0 the analyze post-step fails with "Loaded a configuration file for version '4.38.1', but running version '4.38.0'", so neither PR can pass the codeql gate alone and merging either one would break the gate on main. This bumps all three to 1c5b675653bb5c22dbe9b12b556ec555138e09fd, which is the commit the upstream v4.38.1 annotated tag points to. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
44 lines
1.2 KiB
YAML
44 lines
1.2 KiB
YAML
name: CodeQL SAST
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
analyze:
|
|
runs-on: ubuntu-latest
|
|
# CodeQL needs security-events: write to upload results; scoped to this job so
|
|
# the workflow's top-level token stays read-only (Scorecard TokenPermissions).
|
|
permissions:
|
|
security-events: write
|
|
actions: read
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Install build dependencies
|
|
run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
|
|
with:
|
|
languages: c-cpp
|
|
build-mode: manual
|
|
|
|
- name: Build for CodeQL analysis
|
|
run: scripts/build.sh
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
|
|
with:
|
|
category: "/language:c-cpp"
|