emdash/.github/workflows/security-analysis.yml at main · endformdev/emdash · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: Security Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 6 * * 1"

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  analyze:
    name: Security Analysis
    runs-on: ubuntu-latest
    permissions:
      security-events: write # upload CodeQL and zizmor SARIF
      contents: read
      actions: read # CodeQL reads workflow metadata
      pull-requests: read # paths-filter reads the PR file list
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Detect relevant changes
        id: changes
        if: github.event_name == 'pull_request'
        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          filters: |
            actions:
              - '.github/workflows/**'
              - '.github/actions/**'
            javascript:
              - '**/*.ts'
              - '**/*.tsx'
              - '**/*.js'
              - '**/*.jsx'
              - '**/*.mjs'
              - '**/*.cjs'
              - '**/package.json'
              - '**/pnpm-lock.yaml'
            zizmor:
              - '.github/workflows/**'
              - '.github/actions/**'
              - '.github/zizmor.yml'

      - name: Select analyzers
        id: select
        env:
          EVENT_NAME: ${{ github.event_name }}
          ACTIONS_CHANGED: ${{ steps.changes.outputs.actions }}
          JAVASCRIPT_CHANGED: ${{ steps.changes.outputs.javascript }}
          ZIZMOR_CHANGED: ${{ steps.changes.outputs.zizmor }}
        run: |
          if [ "$EVENT_NAME" != pull_request ]; then
            actions=true
            javascript=true
            zizmor=true
          else
            actions="$ACTIONS_CHANGED"
            javascript="$JAVASCRIPT_CHANGED"
            zizmor="$ZIZMOR_CHANGED"
          fi

          languages=()
          if [ "$actions" = true ]; then languages+=(actions); fi
          if [ "$javascript" = true ]; then languages+=(javascript-typescript); fi
          language_csv=$(IFS=,; echo "${languages[*]}")
          {
            echo "actions=$actions"
            echo "javascript=$javascript"
            echo "zizmor=$zizmor"
            echo "languages=$language_csv"
            if [ "${#languages[@]}" -gt 0 ]; then echo "codeql=true"; else echo "codeql=false"; fi
          } >> "$GITHUB_OUTPUT"

      - name: Initialize CodeQL
        if: steps.select.outputs.codeql == 'true'
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          config-file: ./.github/codeql-config.yml
          languages: ${{ steps.select.outputs.languages }}

      - name: Perform CodeQL analysis
        if: steps.select.outputs.codeql == 'true'
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

      - name: Write empty Actions CodeQL result
        if: always() && steps.select.outputs.actions != 'true'
        run: |
          mkdir -p empty-codeql-actions
          cat > empty-codeql-actions/result.sarif <<'EOF'
          {"version":"2.1.0","$schema":"https://json.schemastore.org/sarif-2.1.0.json","runs":[{"tool":{"driver":{"name":"CodeQL","semanticVersion":"0.0.0","rules":[]}},"results":[],"automationDetails":{"id":"/language:actions/"}}]}
          EOF
      - name: Upload empty Actions CodeQL result
        if: always() && steps.select.outputs.actions != 'true'
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: empty-codeql-actions/result.sarif
          category: /language:actions

      - name: Write empty JavaScript CodeQL result
        if: always() && steps.select.outputs.javascript != 'true'
        run: |
          mkdir -p empty-codeql-javascript
          cat > empty-codeql-javascript/result.sarif <<'EOF'
          {"version":"2.1.0","$schema":"https://json.schemastore.org/sarif-2.1.0.json","runs":[{"tool":{"driver":{"name":"CodeQL","semanticVersion":"0.0.0","rules":[]}},"results":[],"automationDetails":{"id":"/language:javascript-typescript/"}}]}
          EOF
      - name: Upload empty JavaScript CodeQL result
        if: always() && steps.select.outputs.javascript != 'true'
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: empty-codeql-javascript/result.sarif
          category: /language:javascript-typescript

      - name: Run zizmor
        if: always() && steps.select.outputs.zizmor == 'true'
        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
        with:
          version: "1.26.1"

      - name: Write empty zizmor result
        if: always() && steps.select.outputs.zizmor != 'true'
        run: |
          cat > zizmor.sarif <<'EOF'
          {"version":"2.1.0","$schema":"https://json.schemastore.org/sarif-2.1.0.json","runs":[{"tool":{"driver":{"name":"zizmor","semanticVersion":"0.0.0","rules":[]}},"results":[],"automationDetails":{"id":"zizmor/"}}]}
          EOF
      - name: Upload empty zizmor result
        if: always() && steps.select.outputs.zizmor != 'true'
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: zizmor.sarif
          category: zizmor