cli/.github/workflows/codeql-analysis.yml at main · godaddy/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
name: CodeQL

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '19 21 * * 3'

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

      # Rust is analyzed without a build, so there is no build step. The extractor
      # runs its own cargo commands (build scripts, proc macros) in a scratch
      # target dir that is empty on every run unless we point it somewhere
      # persistent, so cache that dir along with the registry.
      - name: Cache extractor cargo output
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            ${{ runner.temp }}/codeql-rust-target
          key: ${{ runner.os }}-codeql-cargo-${{ hashFiles('rust/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-codeql-cargo-

      - name: Initialize CodeQL
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: rust

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        env:
          CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"trace-command":["--extractor-option","rust.cargo_target_dir=${{ runner.temp }}/codeql-rust-target"]}}'