github/.github/workflows/_scan-codeql.yml at main · saan800/github · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
name: scan-codeql

on:
  workflow_call:
    inputs:
      harden-runner-policy:
        description: "The egress policy for the Harden Runner step. Defaults to 'block'"
        required: false
        type: string
        default: "block"
      os:
        required: false
        type: string
        default: ubuntu-latest
      dotnet-version:
        description: "Dotnet SDK version to use if no matrix is provided"
        required: false
        type: string
        default: 10.0.x
      language:
        description: "Language to scan for. eg csharp"
        required: true
        type: string
      timeout-minutes:
        required: false
        type: number
        default: 360

permissions:
  actions: read
  contents: read
  packages: read
  security-events: write

jobs:
  analyze:
    name: Analyze (${{ inputs.language }})
    # Runner size impacts CodeQL analysis time. To learn more, please see:
    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
    #   - https://gh.io/supported-runners-and-hardware-resources
    #   - https://gh.io/using-larger-runners
    # Consider using larger runners for possible analysis time improvements.
    runs-on: ${{ inputs.os }}
    timeout-minutes: ${{ inputs.timeout-minutes }}
    permissions:
      # only required for workflows in private repositories
      actions: read
      contents: read

      # required to fetch internal or private CodeQL packs
      packages: read

      # required for all workflows
      security-events: write

    strategy:
      fail-fast: false

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          disable-sudo: true
          egress-policy: ${{ inputs.harden-runner-policy }}
          allowed-endpoints: >
            aka.ms:443
            api.github.com:443
            api.nuget.org:443
            builds.dotnet.microsoft.com:443
            ci.dot.net:443
            crl3.digicert.com:80
            crl4.digicert.com:80
            dc.services.visualstudio.com:443
            github.com:443
            objects.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            s.symcb.com:80
            ts-crl.ws.symantec.com:80
            uploads.github.com:443
            www.microsoft.com:80

      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup .NET SDK ${{ inputs.dotnet-version }}
        if: inputs.language == 'csharp'
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
        with:
          dotnet-version: ${{ inputs.dotnet-version }}

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          languages: ${{ inputs.language }}
          build-mode: autobuild
          # If you wish to specify custom queries, you can do so here or in a config file.
          # By default, queries listed here will override any specified in a config file.
          # Prefix the list here with "+" to use these queries and those in the config file.

          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
          # queries: security-extended,security-and-quality


      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        with:
          category: "/language:${{inputs.language}}"