sim/.github/workflows/codeql.yml at main · simstudioai/sim · GitHub

View runs

History

118 lines (109 loc) · 4.97 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

name: CodeQL

# Advanced setup, replacing the repo-settings "default setup".

# Default setup pinned every scan to a 4-vCPU GitHub-hosted runner with no

# cancel-in-progress, which put PR scans at 30-125 min and re-ran them on every

# push (PR #6183 burned six overlapping runs). None of that is configurable from

# the settings UI, so the config moves into the repo.

# Before enabling this, disable default setup or the two will both run:

# gh api -X PATCH repos/:owner/:repo/code-scanning/default-setup -f state=not-configured

# The runs-on expression is the same CI_PROVIDER escape hatch as ci.yml and must

# change together with it.

on:

# Pushes to main are infrequent (merges only), so a full scan per push is

# affordable and is what GitHub recommends pairing with the PR trigger:

# "Scanning code when someone pushes a change, and whenever a pull request is

# created, prevents developers from introducing new vulnerabilities."

push:

branches: [main]

# main only, not staging. Feature PRs land on staging and are ~90% of PR scan

# volume, and every one of them is scanned again — against the exact tree being

# promoted — when the staging->main PR opens. Scanning at the promotion

# boundary defers the signal rather than dropping it.

# Deliberately a branch cut and not an activity-type cut: dropping

# `synchronize` would have scanned each PR's first commit and never its final

# state, which is backwards, since review fixups land in later pushes.

pull_request:

branches: [main]

# `ready_for_review` is not a default activity type, so it has to be listed

# alongside the defaults it replaces. Without it, a PR opened as a draft and

# then marked ready is skipped by the job-level draft guard and never

# rescanned until the next push.

types: [opened, synchronize, reopened, ready_for_review]

paths:

- '**/*.ts'

- '**/*.tsx'

- '**/*.js'

- '**/*.jsx'

- '**/*.mjs'

- '**/*.cjs'

- '.github/workflows/**'

- '.github/actions/**'

- '.github/codeql/**'

schedule:

# Safety net behind the push trigger, and the thing that keeps the

# default-branch alert view fresh when main is quiet. Only fires once this

# file is on the default branch — schedule events ignore other branches.

# Daily rather than weekly. Pushes to main are rare, and with PR scans now

# limited to main the alert view leans on this more than it used to; a week

# is too long to leave it stale. It also reseeds the overlay-base database

# that PR runs restore from — that cache key embeds the CodeQL bundle

# version, so a bundle bump invalidates it, and an unused Actions cache is

# evicted after 7 days. One 8 vCPU default-branch scan a day is a few

# dollars a month against a PR scan that halves when the base is warm.

- cron: '17 8 * * *'

workflow_dispatch:

concurrency:

group: codeql-${{ github.ref }}

cancel-in-progress: true

permissions:

contents: read

jobs:

analyze:

name: Analyze ${{ matrix.language }}

# Sized per language, not per workflow. The two analyses are nothing alike:

# javascript-typescript peaks at 19.5 GB (p95 over 3090 runs), so it needs

# the 8 vCPU tier's 30.4 GB and would OOM on the 4 vCPU tier's 15.2 GB; the

# actions analysis peaks at 1.3 GB and averages 22% CPU over a 39s median

# run, so 8 vCPU was 4x more machine than it ever used.

runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || 'ubuntu-latest' }}

timeout-minutes: 60

if: github.event.pull_request.draft != true

permissions:

security-events: write

contents: read

actions: read

strategy:

fail-fast: false

matrix:

# One entry covers both JS and TS — `javascript`, `typescript` and

# `javascript-typescript` all resolve to the same extractor

# (github/codeql-action src/languages/builtin.json), so the three

# entries default setup listed were one analysis, not three.

# `javascript-typescript` is the documented spelling. Python dropped:

# 7 files in the tree.

include:

- language: javascript-typescript

bs_runner: blacksmith-8vcpu-ubuntu-2404

- language: actions

bs_runner: blacksmith-4vcpu-ubuntu-2404

steps:

- name: Checkout repository

uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

with:

persist-credentials: false

- name: Initialize CodeQL

uses: github/codeql-action/init@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2

with:

languages: ${{ matrix.language }}

config-file: ./.github/codeql/codeql-config.yml

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2

env:

NODE_OPTIONS: --max-old-space-size=8192

with:

category: /language:${{ matrix.language }}

sim/.github/workflows/codeql.yml at main · simstudioai/sim · GitHub

Uh oh!

Expand file tree

Breadcrumbs

codeql.yml

Latest commit

History

Breadcrumbs

codeql.yml

File metadata and controls