Merge pull request #175 from DataScience-GT/dev #473
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL Advanced Security Analysis" | |
| on: | |
| push: | |
| branches: [ "main", "dev" ] | |
| pull_request: | |
| branches: [ "main", "dev" ] | |
| schedule: | |
| - cron: '0 2 * * *' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze TypeScript/Next.js | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 360 | |
| # Required permissions for CodeQL | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: javascript-typescript | |
| build-mode: none | |
| # Standard robust query suites catch XSS, SQLi, Logic flaws, etc. | |
| queries: security-extended,security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:javascript-typescript" | |
| dependency-review: | |
| name: Dependency Security Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| contents: read | |
| # Required for dependency-review-action to comment on PRs | |
| pull-requests: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: high | |
| comment-summary-in-pr: always | |
| vulnerability-check: true | |
| security-summary: | |
| name: Security Analysis Summary | |
| needs: [analyze] | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - name: Generate Summary | |
| run: | | |
| echo "# Security Analysis Complete 🛡️" >> $GITHUB_STEP_SUMMARY | |
| echo "The advanced CodeQL analysis and Dependency Review have finished." >> $GITHUB_STEP_SUMMARY | |
| echo "All findings have been uploaded directly to the GitHub Security tab." >> $GITHUB_STEP_SUMMARY | |
| echo "View detailed results at: https://github.com/${{ github.repository }}/security/code-scanning" >> $GITHUB_STEP_SUMMARY |