Merge pull request #187 from Sev7eNup/fix/installer-data-dir-acl-verify #215
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Static security analysis for the two languages that carry the attack surface: the C# | |
| # backend (auth, crypto, remote execution, raw SQL) and the TypeScript frontend. The CI | |
| # workflow only audits *dependencies* (dotnet list --vulnerable / npm audit); nothing looked | |
| # at first-party code until now, which is a gap worth closing on a public repository. | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| schedule: | |
| # Weekly, so newly published queries reach an unchanged main branch too. | |
| - cron: '17 4 * * 1' | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| # C# needs the Windows toolchain: the projects target net10.0-windows and do not build | |
| # on ubuntu. JS/TS has no build step for CodeQL, so it takes the cheaper runner. | |
| runs-on: ${{ matrix.language == 'csharp' && 'windows-latest' || 'ubuntu-latest' }} | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: csharp | |
| build-mode: manual | |
| - language: javascript-typescript | |
| build-mode: none | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 | |
| - name: Setup .NET 10 | |
| if: matrix.language == 'csharp' | |
| uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 | |
| with: | |
| dotnet-version: '10.0.x' | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| queries: security-and-quality | |
| - name: Build | |
| if: matrix.language == 'csharp' | |
| run: dotnet build NodePilot.slnx --configuration Release | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" |