feat: restore/record/export provisioning commands (the "planned CLI") #16
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # | |
| # @Project: @cldmv/.github | |
| # @Filename: /examples/individual-repo-workflows/security/codeql.yml | |
| # @Date: 2026-05-20 00:00:00 -07:00 (1779606000) | |
| # @Author: Nate Corcoran <CLDMV> | |
| # @Email: <Shinrai@users.noreply.github.com> | |
| # @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved. | |
| # | |
| # Individual repo: .github/workflows/codeql.yml | |
| # | |
| # REQUIRED REPO SETTING — CodeQL must be in "Advanced" mode for this workflow | |
| # to upload SARIF. If the repo has CodeQL "Default setup" enabled (the | |
| # GitHub-managed alternative), upload runs fail with: | |
| # | |
| # "Code Scanning could not process the submitted SARIF file: CodeQL | |
| # analyses from advanced configurations cannot be processed when the | |
| # default setup is enabled" | |
| # | |
| # The org-bootstrap-repo action automatically disables default setup | |
| # (overwrite-with-warn) on every fanout run, so a freshly-bootstrapped | |
| # repo lands in the right state by default. If you want to KEEP default | |
| # setup (the GitHub-managed config) instead of this workflow, DELETE | |
| # this codeql.yml file — with the conflict gone, the bootstrap leaves | |
| # default setup alone on subsequent runs. | |
| # | |
| # Manual fix when running outside the bootstrap: | |
| # Settings → Code security and analysis → Code scanning → CodeQL | |
| # analysis → ⚙️ → Switch to advanced. | |
| name: 🔍 CodeQL | |
| on: | |
| push: | |
| branches: [master, main] | |
| # Same fork-PR consideration as ci.yml: pull_request fires for forks; SARIF | |
| # upload to base-repo Security tab fails with read-only token. Acceptable — | |
| # push-to-master analysis after merge catches anything missed. DO NOT use | |
| # pull_request_target (runs base-repo workflow with secrets against fork | |
| # code; dangerous). | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| # Include the v4 integration branches (`next`, `hotfixes`) so feature | |
| # and hotfix PRs trigger CodeQL. Without these, branch protection | |
| # rulesets that require the CodeQL check on `next`/`hotfixes` will | |
| # sit on "waiting for results" indefinitely. Branches that don't | |
| # exist in a given repo simply never trigger the workflow — harmless | |
| # for repos that haven't adopted the v4 staging-branch flow. | |
| branches: [master, main, next, hotfixes] | |
| schedule: | |
| - cron: "37 14 * * 1" # weekly Monday 14:37 UTC; GitHub updates queries over time | |
| permissions: | |
| security-events: write | |
| contents: read | |
| actions: read | |
| concurrency: | |
| group: codeql-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main' }} | |
| jobs: | |
| analyze: | |
| uses: CLDMV/.github/.github/workflows/reusable-codeql.yml@v4 | |
| with: | |
| languages: "javascript-typescript" | |
| # Override defaults if needed: | |
| # queries: "security-extended,security-and-quality" | |
| # paths_ignore: "node_modules/,dist/,coverage/,**/test/**" | |
| # config_file: ".github/codeql-config.yml" | |
| # build_mode: "autobuild" |