mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-11-07 10:40:47 +00:00
Oliver Kieselbach
d26d877989
The SWA CLI lockfile moves from .github/tools/swa-cli to tools/swa-cli: Dependabot's update PR for the old folder was refused. deploy-web and the Dependabot entry follow. Its package.json overrides adm-zip (^0.6.1) and tmp (^0.2.7), which the CLI still pins below the versions that fix their advisories. The CLI's own extract call works on adm-zip 0.6.1, and swa --version and swa deploy --help load. .gitmodules sets update = none for the three private submodules, so recursive clones skip them. Public clones no longer fail on them, and Dependabot's NuGet updater, which clones with --recurse-submodules and aborts on any failure, can run again. A clone with access sets submodule.<name>.update = checkout once. The web postcss override becomes "$postcss": it follows the devDependency that Dependabot bumps instead of conflicting with it. The lockfile is unchanged. zizmor.yml moves to .github/zizmor.yml, where zizmor finds it on its own; CI, CodeQL and the workflow gates watch the new path. Decision D-417. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
129 lines
4.6 KiB
YAML
129 lines
4.6 KiB
YAML
name: CodeQL
|
|
|
|
# Documentation-only changes and private-submodule gitlink bumps (internal/, infra/,
|
|
# .claude/commands) cannot affect what CodeQL analyzes (C# and TypeScript), so they
|
|
# are filtered out rather than spending ~10 minutes to re-report an unchanged result.
|
|
# A gitlink bump reports the bare path ('internal', no trailing slash), which
|
|
# 'internal/**' does NOT match — both forms are listed. A commit that touches docs
|
|
# AND code still runs: GitHub skips only when EVERY changed path matches the filter.
|
|
# Same list as ci.yml except that each file leaves itself out; keep them in step.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- 'internal'
|
|
- 'internal/**'
|
|
- 'infra'
|
|
- 'infra/**'
|
|
- '.claude/**'
|
|
- '.gitmodules'
|
|
- '.github/zizmor.yml'
|
|
- '**/*.md'
|
|
- 'LICENSE'
|
|
- '.github/ISSUE_TEMPLATE/**'
|
|
- '.github/FUNDING.yml'
|
|
- '.github/dependabot.yml'
|
|
- '.github/assets/**'
|
|
- '.github/scripts/**'
|
|
# Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
|
|
# paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
|
|
# .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
|
|
- '.github/workflows/action-pins.yml'
|
|
- '.github/workflows/bootstrap-script-gates.yml'
|
|
- '.github/workflows/build-agent.yml'
|
|
- '.github/workflows/build-msi.yml'
|
|
- '.github/workflows/ci.yml'
|
|
- '.github/workflows/combine-rules.yml'
|
|
- '.github/workflows/deploy-backend.yml'
|
|
- '.github/workflows/deploy-mcp.yml'
|
|
- '.github/workflows/deploy-web.yml'
|
|
- '.github/workflows/indexnow-notify.yml'
|
|
- '.github/workflows/publish-scripts.yml'
|
|
pull_request:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- 'internal'
|
|
- 'internal/**'
|
|
- 'infra'
|
|
- 'infra/**'
|
|
- '.claude/**'
|
|
- '.gitmodules'
|
|
- '.github/zizmor.yml'
|
|
- '**/*.md'
|
|
- 'LICENSE'
|
|
- '.github/ISSUE_TEMPLATE/**'
|
|
- '.github/FUNDING.yml'
|
|
- '.github/dependabot.yml'
|
|
- '.github/assets/**'
|
|
- '.github/scripts/**'
|
|
# Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
|
|
# paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
|
|
# .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
|
|
- '.github/workflows/action-pins.yml'
|
|
- '.github/workflows/bootstrap-script-gates.yml'
|
|
- '.github/workflows/build-agent.yml'
|
|
- '.github/workflows/build-msi.yml'
|
|
- '.github/workflows/ci.yml'
|
|
- '.github/workflows/combine-rules.yml'
|
|
- '.github/workflows/deploy-backend.yml'
|
|
- '.github/workflows/deploy-mcp.yml'
|
|
- '.github/workflows/deploy-web.yml'
|
|
- '.github/workflows/indexnow-notify.yml'
|
|
- '.github/workflows/publish-scripts.yml'
|
|
schedule:
|
|
# Weekly, so advisories published after a merge still surface. Deliberately
|
|
# unfiltered — it re-analyzes the whole tree regardless of what changed, which
|
|
# is also the backstop if the filters above ever skip too much.
|
|
- cron: '17 3 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze ${{ matrix.language }}
|
|
runs-on: ${{ matrix.runner }}
|
|
permissions:
|
|
security-events: write
|
|
packages: read
|
|
actions: read
|
|
contents: read
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# csharp needs the net48 agent projects to build, so Windows.
|
|
- language: csharp
|
|
runner: windows-latest
|
|
build-mode: manual
|
|
- language: javascript-typescript
|
|
runner: ubuntu-latest
|
|
build-mode: none
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
|
|
if: matrix.language == 'csharp'
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
config-file: .github/codeql/codeql-config.yml
|
|
|
|
- name: Build
|
|
if: matrix.build-mode == 'manual'
|
|
run: dotnet build AutopilotMonitor.sln --configuration Release
|
|
|
|
- name: Analyze
|
|
uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
|
|
with:
|
|
category: /language:${{ matrix.language }}
|