From 177c6476a459d51dfa113b75dbe0ef5dddb9205c Mon Sep 17 00:00:00 2001 From: Chad Pritchett Date: Mon, 17 Nov 2025 02:35:29 -0600 Subject: [PATCH 1/3] fix(workflows): update codeql action version --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 83812a3..d8ff4e6 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -7,7 +7,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - - uses: github/codeql-action/init@v1 + - uses: github/codeql-action/init@v4.31.3 with: languages: python - - uses: github/codeql-action/analyze@v1 + - uses: github/codeql-action/analyze@v4.31.3 From 248283dc428319464ef8b6fc265e4bbc4341c3d3 Mon Sep 17 00:00:00 2001 From: Chad Pritchett Date: Mon, 17 Nov 2025 02:42:49 -0600 Subject: [PATCH 2/3] Update codeql.yml --- .github/workflows/codeql.yml | 43 ++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 7 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d8ff4e6..e0cef5d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,13 +1,42 @@ name: "CodeQL analysis" -on: [pull_request] +on: + pull_request: + push: + branches: [main] + schedule: + - cron: '30 1 * * 0' # Weekly scan jobs: - build: + codeql-analyze: + name: Analyze (${{ matrix.language }}) runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write # Needed for uploading SARIF + strategy: + fail-fast: false + matrix: + language: ['python'] + build-mode: ['autobuild'] # Use manual here if needed + steps: - - uses: actions/checkout@v2 - - uses: github/codeql-action/init@v4.31.3 - with: - languages: python - - uses: github/codeql-action/analyze@v4.31.3 + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v4.31.3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + # config-file: .github/codeql-config.yaml # If using custom queries + + # If you need a manual build, add your build steps here + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v4.31.3 + with: + category: "/language:${{ matrix.language }}" + + # SARIF reports are uploaded automatically by the 'analyze' step. From 79f0084f87bb99b94eeda0e5be01b38e0dda4a8e Mon Sep 17 00:00:00 2001 From: Chad Pritchett Date: Mon, 17 Nov 2025 02:54:24 -0600 Subject: [PATCH 3/3] Update codeql.yml --- .github/workflows/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e0cef5d..845f1ef 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -19,7 +19,7 @@ jobs: fail-fast: false matrix: language: ['python'] - build-mode: ['autobuild'] # Use manual here if needed + build-mode: ['none'] # Use manual here if needed steps: - name: Checkout repository