mirror of
https://github.com/github/codeql.git
synced 2026-01-04 10:10:20 +01:00
b58c856756
Repositories can be configured with Default access (restricted) https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token Best practice says that workflows should declare the minimal permissions they require. Without declaring permissions, paranoid forks fail miserably.
37 lines
965 B
YAML
37 lines
965 B
YAML
name: Build framework coverage timeseries reports
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Clone self (github/codeql)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
path: script
|
|
- name: Clone self (github/codeql) for analysis
|
|
uses: actions/checkout@v4
|
|
with:
|
|
path: codeqlModels
|
|
fetch-depth: 0
|
|
- name: Set up Python 3.8
|
|
uses: actions/setup-python@v4
|
|
with:
|
|
python-version: 3.8
|
|
- name: Download CodeQL CLI
|
|
uses: ./script/.github/actions/fetch-codeql
|
|
- name: Build modeled package list
|
|
run: |
|
|
python script/misc/scripts/library-coverage/generate-timeseries.py codeqlModels
|
|
- name: Upload timeseries CSV
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: framework-coverage-timeseries
|
|
path: framework-coverage-timeseries-*.csv
|