mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
c26542776e
Every job that runs third-party code (restore, build, tests, npm ci, next build, wix) now holds only a read-only token and hands its output on as one archive. Signing, publishing and deploying happen in separate jobs on a fresh runner that run only this repository's scripts and pinned actions, unpack artifacts outside the checkout and take no build-job output into a script. - build-agent: reserve -> build -> release - build-msi: sign-loader -> build -> release - deploy-backend: reserve -> build -> deploy (publish output as one tar.gz) - deploy-web: build -> deploy (SWA token only, no id-token) -> record - combine-rules: validate (read-only, PRs too) -> publish (push to main only) - deploy-mcp: same shape; documents docker build as its boundary Deploy-only jobs run in the production environment. The jobs that sign stay without an environment for now: a job carries one OIDC subject, and the signing identity still trusts the ref. oidc-login-test.yml is removed; combine-rules no longer triggers on the dev branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
129 lines
4.6 KiB
YAML
129 lines
4.6 KiB
YAML
name: CodeQL
|
|
|
|
# Documentation-only changes and private-submodule gitlink bumps (internal/, infra/,
|
|
# .claude/commands) cannot affect what CodeQL analyzes (C# and TypeScript), so they
|
|
# are filtered out rather than spending ~10 minutes to re-report an unchanged result.
|
|
# A gitlink bump reports the bare path ('internal', no trailing slash), which
|
|
# 'internal/**' does NOT match — both forms are listed. A commit that touches docs
|
|
# AND code still runs: GitHub skips only when EVERY changed path matches the filter.
|
|
# Same list as ci.yml except that each file leaves itself out; keep them in step.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- 'internal'
|
|
- 'internal/**'
|
|
- 'infra'
|
|
- 'infra/**'
|
|
- '.claude/**'
|
|
- '.gitmodules'
|
|
- 'zizmor.yml'
|
|
- '**/*.md'
|
|
- 'LICENSE'
|
|
- '.github/ISSUE_TEMPLATE/**'
|
|
- '.github/FUNDING.yml'
|
|
- '.github/dependabot.yml'
|
|
- '.github/assets/**'
|
|
- '.github/scripts/**'
|
|
# Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
|
|
# paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
|
|
# .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
|
|
- '.github/workflows/bootstrap-script-gates.yml'
|
|
- '.github/workflows/build-agent.yml'
|
|
- '.github/workflows/build-msi.yml'
|
|
- '.github/workflows/ci.yml'
|
|
- '.github/workflows/combine-rules.yml'
|
|
- '.github/workflows/deploy-backend.yml'
|
|
- '.github/workflows/deploy-mcp.yml'
|
|
- '.github/workflows/deploy-web.yml'
|
|
- '.github/workflows/indexnow-notify.yml'
|
|
- '.github/workflows/pester.yml'
|
|
- '.github/workflows/publish-scripts.yml'
|
|
pull_request:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- 'internal'
|
|
- 'internal/**'
|
|
- 'infra'
|
|
- 'infra/**'
|
|
- '.claude/**'
|
|
- '.gitmodules'
|
|
- 'zizmor.yml'
|
|
- '**/*.md'
|
|
- 'LICENSE'
|
|
- '.github/ISSUE_TEMPLATE/**'
|
|
- '.github/FUNDING.yml'
|
|
- '.github/dependabot.yml'
|
|
- '.github/assets/**'
|
|
- '.github/scripts/**'
|
|
# Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
|
|
# paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
|
|
# .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
|
|
- '.github/workflows/bootstrap-script-gates.yml'
|
|
- '.github/workflows/build-agent.yml'
|
|
- '.github/workflows/build-msi.yml'
|
|
- '.github/workflows/ci.yml'
|
|
- '.github/workflows/combine-rules.yml'
|
|
- '.github/workflows/deploy-backend.yml'
|
|
- '.github/workflows/deploy-mcp.yml'
|
|
- '.github/workflows/deploy-web.yml'
|
|
- '.github/workflows/indexnow-notify.yml'
|
|
- '.github/workflows/pester.yml'
|
|
- '.github/workflows/publish-scripts.yml'
|
|
schedule:
|
|
# Weekly, so advisories published after a merge still surface. Deliberately
|
|
# unfiltered — it re-analyzes the whole tree regardless of what changed, which
|
|
# is also the backstop if the filters above ever skip too much.
|
|
- cron: '17 3 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze ${{ matrix.language }}
|
|
runs-on: ${{ matrix.runner }}
|
|
permissions:
|
|
security-events: write
|
|
packages: read
|
|
actions: read
|
|
contents: read
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
# csharp needs the net48 agent projects to build, so Windows.
|
|
- language: csharp
|
|
runner: windows-latest
|
|
build-mode: manual
|
|
- language: javascript-typescript
|
|
runner: ubuntu-latest
|
|
build-mode: none
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
|
|
if: matrix.language == 'csharp'
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
config-file: .github/codeql/codeql-config.yml
|
|
|
|
- name: Build
|
|
if: matrix.build-mode == 'manual'
|
|
run: dotnet build AutopilotMonitor.sln --configuration Release
|
|
|
|
- name: Analyze
|
|
uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
|
|
with:
|
|
category: /language:${{ matrix.language }}
|