mirror of
https://github.com/github/codeql.git
synced 2026-01-04 10:10:20 +01:00
b58c856756
Repositories can be configured with Default access (restricted) https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token Best practice says that workflows should declare the minimal permissions they require. Without declaring permissions, paranoid forks fail miserably.
44 lines
1.1 KiB
YAML
44 lines
1.1 KiB
YAML
name: Build code scanning query list
|
||
|
||
on:
|
||
push:
|
||
branches:
|
||
- main
|
||
- 'rc/**'
|
||
tags:
|
||
- 'codeql-cli/*'
|
||
pull_request:
|
||
paths:
|
||
- '.github/workflows/query-list.yml'
|
||
- '.github/actions/fetch-codeql/action.yml'
|
||
- 'misc/scripts/generate-code-scanning-query-list.py'
|
||
|
||
permissions:
|
||
contents: read
|
||
|
||
jobs:
|
||
build:
|
||
|
||
runs-on: ubuntu-latest
|
||
|
||
steps:
|
||
- name: Clone self (github/codeql)
|
||
uses: actions/checkout@v4
|
||
with:
|
||
path: codeql
|
||
- name: Set up Python 3.8
|
||
uses: actions/setup-python@v4
|
||
with:
|
||
python-version: 3.8
|
||
- name: Download CodeQL CLI
|
||
# Look under the `codeql` directory, as this is where we checked out the `github/codeql` repo
|
||
uses: ./codeql/.github/actions/fetch-codeql
|
||
- name: Build code scanning query list
|
||
run: |
|
||
python codeql/misc/scripts/generate-code-scanning-query-list.py > code-scanning-query-list.csv
|
||
- name: Upload code scanning query list
|
||
uses: actions/upload-artifact@v3
|
||
with:
|
||
name: code-scanning-query-list
|
||
path: code-scanning-query-list.csv
|