Skip to content

Commit a7dc5d1

Browse files
lucacomelucacome
committed
Bump CodeQL actions to v2.20.0
Apparently somebody tagged the wrong thing in the CodeQL repo and dependabot wasn't able to update the Actions anymore.
1 parent 9840615 commit a7dc5d1

File tree

4 files changed

+57
-53
lines changed

4 files changed

+57
-53
lines changed

‎.github/workflows/build-oss.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ jobs:
157157
ignore-unfixed: "true"
158158

159159
- name: Upload Trivy scan results to GitHub Security tab
160-
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
160+
uses: github/codeql-action/upload-sarif@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0
161161
continue-on-error: true
162162
with:
163163
sarif_file: "trivy-results-${{ inputs.image }}.sarif"

‎.github/workflows/build-plus.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,17 @@ defaults:
2020
run:
2121
shell: bash
2222

23-
permissions: # added using https://github.com/step-security/secure-workflows
23+
permissions:
2424
contents: read
2525

2626
jobs:
2727
build:
28-
permissions:
29-
contents: read # for docker/build-push-action to read repo content
30-
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
31-
id-token: write # for OIDC login to AWS
32-
runs-on: ubuntu-22.04
33-
steps:
28+
permissions:
29+
contents: read # for docker/build-push-action to read repo content
30+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
31+
id-token: write # for OIDC login to AWS
32+
runs-on: ubuntu-22.04
33+
steps:
3434
- name: Checkout Repository
3535
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
3636
with:
@@ -119,7 +119,7 @@ jobs:
119119
uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
120120
with:
121121
file: build/Dockerfile
122-
context: '.'
122+
context: "."
123123
cache-from: type=gha,scope=${{ inputs.image }}${{ contains(inputs.nap_modules, 'dos') && '-dos' || '' }}${{ contains(inputs.nap_modules, 'waf') && '-nap' || '' }}
124124
cache-to: type=gha,scope=${{ inputs.image }}${{ contains(inputs.nap_modules, 'dos') && '-dos' || '' }}${{ contains(inputs.nap_modules, 'waf') && '-nap' || '' }},mode=max
125125
target: ${{ inputs.target }}
@@ -146,7 +146,7 @@ jobs:
146146
uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
147147
with:
148148
file: build/Dockerfile
149-
context: '.'
149+
context: "."
150150
cache-from: type=gha,scope=${{ inputs.image }}
151151
target: ${{ inputs.target }}
152152
tags: docker.io/${{ inputs.image }}:${{ steps.meta.outputs.version }}
@@ -166,20 +166,20 @@ jobs:
166166
continue-on-error: true
167167
with:
168168
image-ref: docker.io/${{ inputs.image }}:${{ steps.meta.outputs.version }}
169-
format: 'sarif'
170-
output: 'trivy-results-${{ inputs.image }}.sarif'
171-
ignore-unfixed: 'true'
169+
format: "sarif"
170+
output: "trivy-results-${{ inputs.image }}.sarif"
171+
ignore-unfixed: "true"
172172

173173
- name: Upload Trivy scan results to GitHub Security tab
174-
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
174+
uses: github/codeql-action/upload-sarif@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0
175175
continue-on-error: true
176176
with:
177-
sarif_file: 'trivy-results-${{ inputs.image }}.sarif'
177+
sarif_file: "trivy-results-${{ inputs.image }}.sarif"
178178

179179
- name: Upload Scan Results
180180
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
181181
continue-on-error: true
182182
with:
183-
name: 'trivy-results-${{ inputs.image }}.sarif'
184-
path: 'trivy-results-${{ inputs.image }}.sarif'
183+
name: "trivy-results-${{ inputs.image }}.sarif"
184+
path: "trivy-results-${{ inputs.image }}.sarif"
185185
if: always()

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 36 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -2,63 +2,66 @@ name: "CodeQL"
22

33
on:
44
push:
5-
branches: [ main, release-* ]
5+
branches:
6+
- main
7+
- release-*
68
pull_request:
79
# The branches below must be a subset of the branches above
8-
branches: [ main ]
10+
branches:
11+
- main
912
schedule:
10-
- cron: '36 6 * * 4' # run every Thursday at 06:36 UTC
13+
- cron: "36 6 * * 4" # run every Thursday at 06:36 UTC
1114

1215
concurrency:
1316
group: ${{ github.ref_name }}-codeql
1417
cancel-in-progress: true
1518

16-
permissions: # added using https://github.com/step-security/secure-workflows
19+
permissions:
1720
contents: read
1821

1922
jobs:
2023
analyze:
2124
permissions:
22-
actions: read # for github/codeql-action/init to get workflow details
23-
contents: read # for actions/checkout to fetch code
24-
security-events: write # for github/codeql-action/autobuild to send a status report
25+
actions: read # for github/codeql-action/init to get workflow details
26+
contents: read # for actions/checkout to fetch code
27+
security-events: write # for github/codeql-action/autobuild to send a status report
2528
name: Analyze
2629
runs-on: ubuntu-latest
2730

2831
strategy:
2932
fail-fast: false
3033
matrix:
31-
language: [ 'go', 'python' ]
34+
language: ["go", "python"]
3235

3336
steps:
34-
- name: Checkout repository
35-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
37+
- name: Checkout repository
38+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
3639

37-
# Initializes the CodeQL tools for scanning.
38-
- name: Initialize CodeQL
39-
uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
40-
with:
41-
languages: ${{ matrix.language }}
42-
# If you wish to specify custom queries, you can do so here or in a config file.
43-
# By default, queries listed here will override any specified in a config file.
44-
# Prefix the list here with "+" to use these queries and those in the config file.
45-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
40+
# Initializes the CodeQL tools for scanning.
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0
43+
with:
44+
languages: ${{ matrix.language }}
45+
# If you wish to specify custom queries, you can do so here or in a config file.
46+
# By default, queries listed here will override any specified in a config file.
47+
# Prefix the list here with "+" to use these queries and those in the config file.
48+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
4649

47-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
48-
# If this step fails, then you should remove it and run the build manually (see below)
49-
- name: Autobuild
50-
uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
50+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
51+
# If this step fails, then you should remove it and run the build manually (see below)
52+
- name: Autobuild
53+
uses: github/codeql-action/autobuild@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0
5154

52-
# ℹ️ Command-line programs to run using the OS shell.
53-
# 📚 https://git.io/JvXDl
55+
# ℹ️ Command-line programs to run using the OS shell.
56+
# 📚 https://git.io/JvXDl
5457

55-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
56-
# and modify them (or add more) to build your code if your project
57-
# uses a compiled language
58+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
59+
# and modify them (or add more) to build your code if your project
60+
# uses a compiled language
5861

59-
#- run: |
60-
# make bootstrap
61-
# make release
62+
#- run: |
63+
# make bootstrap
64+
# make release
6265

63-
- name: Perform CodeQL Analysis
64-
uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
66+
- name: Perform CodeQL Analysis
67+
uses: github/codeql-action/analyze@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0

‎.github/workflows/scorecards.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ on:
33
# Only the default branch is supported.
44
branch_protection_rule:
55
schedule:
6-
- cron: '43 20 * * 0' # run every Sunday at 20:43 UTC
6+
- cron: "43 20 * * 0" # run every Sunday at 20:43 UTC
77
push:
8-
branches: [ "main" ]
8+
branches:
9+
- main
910

1011
# Declare default permissions as read only.
1112
permissions: read-all
@@ -53,6 +54,6 @@ jobs:
5354

5455
# Upload the results to GitHub's code scanning dashboard.
5556
- name: "Upload to code-scanning"
56-
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
57+
uses: github/codeql-action/upload-sarif@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2.20.0
5758
with:
5859
sarif_file: results.sarif

0 commit comments

Comments
 (0)