mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-11-14 11:08:35 +00:00
splitsec2
67a969d953
CodeQL scans `tests/`, which only runs in CI and the e2e docker stack. That is where the open `py/full-ssrf` (critical) and the two `py/reflective-xss` alerts come from, all in the e2e mock server, plus four `py/incomplete-url-substring-sanitization` alerts on URL asserts. None of them can reach a running instance. This adds `.github/codeql/codeql-config.yml` with `paths-ignore: tests` and points the init step at it. It closes those seven and hides nothing in `shelfmark/` or the frontend. The rest of the open alerts are unchanged. @calibrain I know I have ability to merge this, but wanted you to be the one for this. It clears the test alerts and leaves the rest, and prevents you from having to clear them manually. Just a little QoL.
40 lines
1.0 KiB
YAML
40 lines
1.0 KiB
YAML
name: CodeQL
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: "0 6 * * 1" # Weekly on Monday at 6am UTC
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
analyze:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
language: [python, javascript-typescript]
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v3
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
config-file: ./.github/codeql/codeql-config.yml
|
|
|
|
- name: Autobuild
|
|
uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v3
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v3
|
|
with:
|
|
category: "/language:${{ matrix.language }}"
|