@@ -2,12 +2,22 @@ name: CodeQL
2233on:
44workflow_dispatch:
5+inputs:
6+profile:
7+description: CodeQL profile to run
8+required: false
9+default: all
10+type: choice
11+options:
12+ - all
13+ - security
14+ - quality
515schedule:
616 - cron: "0 6 * * *"
717818concurrency:
9-group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
10-cancel-in-progress: ${{ github.event_name == 'pull_request' }}
19+group: codeql-${{ github.workflow }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || github.sha }}
20+cancel-in-progress: false
11211222env:
1323FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
@@ -18,121 +28,58 @@ permissions:
1828security-events: write
19292030jobs:
21-analyze:
22-name: Analyze (${{ matrix.language }})
31+critical-security:
32+name: Critical Security (${{ matrix.language }})
33+if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'security' }}
2334runs-on: ${{ matrix.runs_on }}
35+timeout-minutes: ${{ matrix.timeout_minutes }}
2436strategy:
2537fail-fast: false
2638matrix:
2739include:
2840 - language: javascript-typescript
29-runs_on: blacksmith-32vcpu-ubuntu-2404
30-needs_node: true
31-needs_python: false
32-needs_java: false
33-needs_swift_tools: false
34-needs_manual_build: false
35-needs_autobuild: false
36-config_file: ./.github/codeql/codeql-javascript-typescript.yml
41+runs_on: ubuntu-24.04
42+timeout_minutes: 25
43+config_file: ./.github/codeql/codeql-javascript-typescript-critical-security.yml
3744 - language: actions
38-runs_on: blacksmith-16vcpu-ubuntu-2404
39-needs_node: false
40-needs_python: false
41-needs_java: false
42-needs_swift_tools: false
43-needs_manual_build: false
44-needs_autobuild: false
45-config_file: ""
46- - language: python
47-runs_on: blacksmith-16vcpu-ubuntu-2404
48-needs_node: false
49-needs_python: true
50-needs_java: false
51-needs_swift_tools: false
52-needs_manual_build: false
53-needs_autobuild: false
54-config_file: ""
55- - language: java-kotlin
56-runs_on: blacksmith-16vcpu-ubuntu-2404
57-needs_node: false
58-needs_python: false
59-needs_java: true
60-needs_swift_tools: false
61-needs_manual_build: true
62-needs_autobuild: false
63-config_file: ""
64- - language: swift
65-runs_on: ${{ github.repository == 'openclaw/openclaw' && 'blacksmith-12vcpu-macos-latest' || 'macos-latest' }}
66-needs_node: false
67-needs_python: false
68-needs_java: false
69-needs_swift_tools: true
70-needs_manual_build: true
71-needs_autobuild: false
72-config_file: ""
45+runs_on: ubuntu-24.04
46+timeout_minutes: 10
47+config_file: ./.github/codeql/codeql-actions-critical-security.yml
7348steps:
7449 - name: Checkout
7550uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
7651with:
7752submodules: false
785379- - name: Setup Node environment
80-if: matrix.needs_node
81-uses: ./.github/actions/setup-node-env
54+ - name: Initialize CodeQL
55+uses: github/codeql-action/init@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
8256with:
83-install-bun: "false"
57+languages: ${{ matrix.language }}
58+config-file: ${{ matrix.config_file }}
845985- - name: Setup Python
86-if: matrix.needs_python
87-uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
60+ - name: Analyze
61+uses: github/codeql-action/analyze@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
8862with:
89-python-version: "3.12"
63+category: "/codeql-critical-security/${{ matrix.language }}"
906491- - name: Setup Java
92-if: matrix.needs_java
93-uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
65+critical-quality:
66+name: Critical Quality (javascript-typescript)
67+if: ${{ github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'quality' }}
68+runs-on: ubuntu-24.04
69+timeout-minutes: 25
70+steps:
71+ - name: Checkout
72+uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
9473with:
95-distribution: temurin
96-java-version: "21"
97-98- - name: Setup Swift build tools
99-if: matrix.needs_swift_tools
100-run: |
101- sudo xcode-select -s /Applications/Xcode_26.1.app
102- xcodebuild -version
103- brew install xcodegen swiftlint swiftformat
104- swift --version
74+submodules: false
1057510676 - name: Initialize CodeQL
10777uses: github/codeql-action/init@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
10878with:
109-languages: ${{ matrix.language }}
110-queries: security-and-quality
111-config-file: ${{ matrix.config_file || '' }}
112-113- - name: Autobuild
114-if: matrix.needs_autobuild
115-uses: github/codeql-action/autobuild@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
116-117- - name: Build Android for CodeQL
118-if: matrix.language == 'java-kotlin'
119-working-directory: apps/android
120-run: ./gradlew --no-daemon :app:assemblePlayDebug
121-122- - name: Build Swift for CodeQL
123-if: matrix.language == 'swift'
124-run: |
125- set -euo pipefail
126- swift build --package-path apps/macos --configuration release
127- cd apps/ios
128- xcodegen generate
129- xcodebuild build \
130- -project OpenClaw.xcodeproj \
131- -scheme OpenClaw \
132- -destination "generic/platform=iOS Simulator" \
133- CODE_SIGNING_ALLOWED=NO
79+languages: javascript-typescript
80+config-file: ./.github/codeql/codeql-javascript-typescript-critical-quality.yml
1348113582 - name: Analyze
13683uses: github/codeql-action/analyze@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
13784with:
138-category: "/language:${{ matrix.language }}"
85+category: "/codeql-critical-quality/javascript-typescript"
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。