v0.8.16: aws lambda, dynamics 365, actorless run fixes, usage chart #3213
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Advanced setup, replacing the repo-settings "default setup". | |
| # | |
| # Default setup pinned every scan to a 4-vCPU GitHub-hosted runner with no | |
| # cancel-in-progress, which put PR scans at 30-125 min and re-ran them on every | |
| # push (PR #6183 burned six overlapping runs). None of that is configurable from | |
| # the settings UI, so the config moves into the repo. | |
| # | |
| # Before enabling this, disable default setup or the two will both run: | |
| # gh api -X PATCH repos/:owner/:repo/code-scanning/default-setup -f state=not-configured | |
| # | |
| # The runs-on expression is the same CI_PROVIDER escape hatch as ci.yml and must | |
| # change together with it. | |
| on: | |
| # Pushes to main are infrequent (merges only), so a full scan per push is | |
| # affordable and is what GitHub recommends pairing with the PR trigger: | |
| # "Scanning code when someone pushes a change, and whenever a pull request is | |
| # created, prevents developers from introducing new vulnerabilities." | |
| push: | |
| branches: [main] | |
| # main only, not staging. Feature PRs land on staging and are ~90% of PR scan | |
| # volume, and every one of them is scanned again — against the exact tree being | |
| # promoted — when the staging->main PR opens. Scanning at the promotion | |
| # boundary defers the signal rather than dropping it. | |
| # | |
| # Deliberately a branch cut and not an activity-type cut: dropping | |
| # `synchronize` would have scanned each PR's first commit and never its final | |
| # state, which is backwards, since review fixups land in later pushes. | |
| pull_request: | |
| branches: [main] | |
| # `ready_for_review` is not a default activity type, so it has to be listed | |
| # alongside the defaults it replaces. Without it, a PR opened as a draft and | |
| # then marked ready is skipped by the job-level draft guard and never | |
| # rescanned until the next push. | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| paths: | |
| - '**/*.ts' | |
| - '**/*.tsx' | |
| - '**/*.js' | |
| - '**/*.jsx' | |
| - '**/*.mjs' | |
| - '**/*.cjs' | |
| - '.github/workflows/**' | |
| - '.github/actions/**' | |
| - '.github/codeql/**' | |
| schedule: | |
| # Safety net behind the push trigger, and the thing that keeps the | |
| # default-branch alert view fresh when main is quiet. Only fires once this | |
| # file is on the default branch — schedule events ignore other branches. | |
| # | |
| # Daily rather than weekly. Pushes to main are rare, and with PR scans now | |
| # limited to main the alert view leans on this more than it used to; a week | |
| # is too long to leave it stale. It also reseeds the overlay-base database | |
| # that PR runs restore from — that cache key embeds the CodeQL bundle | |
| # version, so a bundle bump invalidates it, and an unused Actions cache is | |
| # evicted after 7 days. One 8 vCPU default-branch scan a day is a few | |
| # dollars a month against a PR scan that halves when the base is warm. | |
| - cron: '17 8 * * *' | |
| workflow_dispatch: | |
| concurrency: | |
| group: codeql-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze ${{ matrix.language }} | |
| # Sized per language, not per workflow. The two analyses are nothing alike: | |
| # javascript-typescript peaks at 19.5 GB (p95 over 3090 runs), so it needs | |
| # the 8 vCPU tier's 30.4 GB and would OOM on the 4 vCPU tier's 15.2 GB; the | |
| # actions analysis peaks at 1.3 GB and averages 22% CPU over a 39s median | |
| # run, so 8 vCPU was 4x more machine than it ever used. | |
| runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || 'ubuntu-latest' }} | |
| timeout-minutes: 60 | |
| if: github.event.pull_request.draft != true | |
| permissions: | |
| security-events: write | |
| contents: read | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # One entry covers both JS and TS — `javascript`, `typescript` and | |
| # `javascript-typescript` all resolve to the same extractor | |
| # (github/codeql-action src/languages/builtin.json), so the three | |
| # entries default setup listed were one analysis, not three. | |
| # `javascript-typescript` is the documented spelling. Python dropped: | |
| # 7 files in the tree. | |
| include: | |
| - language: javascript-typescript | |
| bs_runner: blacksmith-8vcpu-ubuntu-2404 | |
| - language: actions | |
| bs_runner: blacksmith-4vcpu-ubuntu-2404 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| with: | |
| persist-credentials: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2 | |
| with: | |
| languages: ${{ matrix.language }} | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2 | |
| env: | |
| NODE_OPTIONS: --max-old-space-size=8192 | |
| with: | |
| category: /language:${{ matrix.language }} |