diff options
| author | Richard Yao <[email protected]> | 2022-10-27 09:36:17 -0700 |
|---|---|---|
| committer | GitHub <[email protected]> | 2022-10-27 09:36:17 -0700 |
| commit | c8ae0ca11a8c61f5e29e05d95feb823dbabb25e2 (patch) | |
| tree | c8f6d414a77a501a0d30143907aea6a74f1e2570 /.github | |
| parent | 07de86923bcb78352a4f4ffef02408f9a7dc794e (diff) | |
Add CodeQL workflow
CodeQL is a static analyzer from github with a very low false positive
rate. We have long wanted to have static analysis runs done on every
pull request and using CodeQL, we can.
Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: George Melikov <[email protected]>
Reviewed-by: Andrew Innes <[email protected]>
Signed-off-by: Richard Yao <[email protected]>
Closes #14087
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/codeql.yml | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..c8a49a7f0 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,36 @@ +name: "CodeQL" + +on: + push: + pull_request: + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'cpp', 'python' ] + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v2 + with: + languages: ${{ matrix.language }} + + - name: Autobuild + uses: github/codeql-action/autobuild@v2 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v2 + with: + category: "/language:${{matrix.language}}" |