mirror of
https://github.com/github/codeql.git
synced 2026-01-05 18:50:23 +01:00
b58c856756
Repositories can be configured with Default access (restricted) https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token Best practice says that workflows should declare the minimal permissions they require. Without declaring permissions, paranoid forks fail miserably.
76 lines
2.6 KiB
YAML
76 lines
2.6 KiB
YAML
name: "Publish framework coverage as metrics"
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '5 0 * * *'
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- ".github/workflows/csv-coverage-metrics.yml"
|
|
- ".github/actions/fetch-codeql/action.yml"
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
publish-java:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
- name: Setup CodeQL
|
|
uses: ./.github/actions/fetch-codeql
|
|
- name: Create empty database
|
|
run: |
|
|
DATABASE="${{ runner.temp }}/java-database"
|
|
PROJECT="${{ runner.temp }}/java-project"
|
|
mkdir -p "$PROJECT/src/tmp/empty"
|
|
echo "class Empty {}" >> "$PROJECT/src/tmp/empty/Empty.java"
|
|
codeql database create "$DATABASE" --language=java --source-root="$PROJECT" --command 'javac src/tmp/empty/Empty.java'
|
|
- name: Capture coverage information
|
|
run: |
|
|
DATABASE="${{ runner.temp }}/java-database"
|
|
codeql database analyze --format=sarif-latest --output=metrics-java.sarif -- "$DATABASE" ./java/ql/src/Metrics/Summaries/FrameworkCoverage.ql
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: metrics-java.sarif
|
|
path: metrics-java.sarif
|
|
retention-days: 20
|
|
- name: Upload SARIF file
|
|
uses: github/codeql-action/upload-sarif@main
|
|
with:
|
|
sarif_file: metrics-java.sarif
|
|
|
|
publish-csharp:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
- name: Setup CodeQL
|
|
uses: ./.github/actions/fetch-codeql
|
|
- name: Create empty database
|
|
run: |
|
|
DATABASE="${{ runner.temp }}/csharp-database"
|
|
PROJECT="${{ runner.temp }}/csharp-project"
|
|
dotnet new classlib --language=C# --output="$PROJECT"
|
|
codeql database create "$DATABASE" --language=csharp --source-root="$PROJECT" --command 'dotnet build /t:rebuild csharp-project.csproj'
|
|
- name: Capture coverage information
|
|
run: |
|
|
DATABASE="${{ runner.temp }}/csharp-database"
|
|
codeql database analyze --format=sarif-latest --output=metrics-csharp.sarif -- "$DATABASE" ./csharp/ql/src/Metrics/Summaries/FrameworkCoverage.ql
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: metrics-csharp.sarif
|
|
path: metrics-csharp.sarif
|
|
retention-days: 20
|
|
- name: Upload SARIF file
|
|
uses: github/codeql-action/upload-sarif@main
|
|
with:
|
|
sarif_file: metrics-csharp.sarif
|