nandi.uk
Fork of daniellemaywood.uk/gleam — Wasm codegen work
1# SPDX-License-Identifier: Apache-2.0
2# SPDX-FileCopyrightText: 2026 The Gleam contributors
3
4name: "CodeQL Advanced"
5
6on:
7 push:
8 branches: ["main"]
9 pull_request:
10 branches: ["main"]
11 schedule:
12 - cron: "29 8 * * 1"
13
14permissions:
15 contents: read
16
17jobs:
18 # Detects security issues in GitHub Actions workflows
19 # See https://codeql.github.com/codeql-query-help/actions/
20 analyze:
21 name: Analyze (${{ matrix.language }})
22 runs-on: "ubuntu-latest"
23 permissions:
24 security-events: write
25 strategy:
26 fail-fast: false
27 matrix:
28 include:
29 - language: actions
30 build-mode: none
31 - language: javascript-typescript
32 build-mode: none
33 - language: rust
34 build-mode: none
35 steps:
36 - name: Checkout repository
37 uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
38 with:
39 persist-credentials: false
40 - name: Initialize CodeQL
41 uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
42 with:
43 languages: ${{ matrix.language }}
44 build-mode: ${{ matrix.build-mode }}
45 - name: Perform CodeQL Analysis
46 uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
47 with:
48 category: "/language:${{matrix.language}}"
49
50 # Detects security issues in GitHub Actions workflows
51 # See https://docs.zizmor.sh/audits/
52 zizmor:
53 name: Zizmor
54 runs-on: ubuntu-latest
55 permissions:
56 security-events: write
57 steps:
58 - name: Checkout repository
59 uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
60 with:
61 persist-credentials: false
62 - name: Run zizmor
63 uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7