nandi.uk
Fork of daniellemaywood.uk/gleam — Wasm codegen work
1# SPDX-License-Identifier: Apache-2.0
2# SPDX-FileCopyrightText: 2026 The Gleam contributors
3
4name: "CodeQL Advanced"
5
6on:
7 push:
8 branches: ["main"]
9 pull_request:
10 branches: ["main"]
11 schedule:
12 - cron: "29 8 * * 1"
13
14permissions:
15 contents: read
16
17jobs:
18 # Detects security issues in GitHub Actions workflows
19 # See https://codeql.github.com/codeql-query-help/actions/
20 analyze:
21 name: Analyze (${{ matrix.language }})
22 runs-on: "ubuntu-latest"
23 permissions:
24 security-events: write
25 strategy:
26 fail-fast: false
27 matrix:
28 include:
29 - language: actions
30 build-mode: none
31 - language: javascript-typescript
32 build-mode: none
33 - language: rust
34 build-mode: none
35 steps:
36 - name: Checkout repository
37 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
38 with:
39 persist-credentials: false
40 - name: Initialize CodeQL
41 uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
42 with:
43 languages: ${{ matrix.language }}
44 build-mode: ${{ matrix.build-mode }}
45 - name: Perform CodeQL Analysis
46 uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
47 with:
48 category: "/language:${{matrix.language}}"
49
50 # Detects security issues in GitHub Actions workflows
51 # See https://docs.zizmor.sh/audits/
52 zizmor:
53 name: Zizmor
54 runs-on: ubuntu-latest
55 permissions:
56 security-events: write
57 steps:
58 - name: Checkout repository
59 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
60 with:
61 persist-credentials: false
62 - name: Run zizmor
63 uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6