diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index aeff878..cde5fbc 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -9,13 +9,16 @@ # the `language` matrix defined below to confirm you have the correct set of # supported CodeQL languages. # + +# yamllint disable rule:line-length --- -name: "CodeQL" +name: 'CodeQL Advanced' on: # yamllint disable-line rule:truthy push: + branches: ['main', 'develop', 'feature/*'] pull_request: - workflow_dispatch: + branches: ['main', 'develop', 'feature/*'] schedule: # ┌───────────── minute (0 - 59) # │ ┌───────────── hour (0 - 23) @@ -26,7 +29,10 @@ on: # yamllint disable-line rule:truthy # │ │ │ │ │ # │ │ │ │ │ # * * * * * - - cron: "24 19 * * 3" + - cron: '24 19 * * 3' + +permissions: + contents: read jobs: analyze: @@ -35,10 +41,8 @@ jobs: # - https://gh.io/recommended-hardware-resources-for-running-codeql # - https://gh.io/supported-runners-and-hardware-resources # - https://gh.io/using-larger-runners (GitHub.com only) - # Consider using larger runners or machines with greater resources - # for possible analysis time improvements. - runs-on: ${{ (matrix.language == 'swift' && 'macos-26') || 'ubuntu-26.04' }} - timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} + # Consider using larger runners or machines with greater resources for possible analysis time improvements. + runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} permissions: # required for all workflows security-events: write @@ -54,10 +58,11 @@ jobs: fail-fast: false matrix: include: + - language: actions + build-mode: none - language: csharp build-mode: autobuild - # yamllint disable rule:line-length - # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' + # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' # Use `c-cpp` to analyze code written in C, C++ or both # Use 'java-kotlin' to analyze code written in Java, Kotlin or both # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both @@ -65,42 +70,42 @@ jobs: # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages - # yamllint enable rule:line-length steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + # Add any setup steps before running the `github/codeql-action/init` action. + # This includes steps like installing compilers or runtimes (`actions/setup-node` + # or others). This is typically only required for manual builds. + # - name: Setup runtime (example) + # uses: actions/setup-example@v1 + # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4.38.2 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - # yamllint disable rule:line-length - # If you wish to specify custom queries, you can do so here or in a config file. # By default, queries listed here will override any specified in a config file. # Prefix the list here with "+" to use these queries and those in the config file. # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs # queries: security-extended,security-and-quality - # yamllint enable rule:line-length - # yamllint disable rule:line-length # If the analyze step fails for one of the languages you are analyzing with # "We were unable to automatically build your code", modify the matrix above # to set the build mode to "manual" for that language. Then modify this step # to build your code. # ℹ️ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - # yamllint enable rule:line-length - - if: matrix.build-mode == 'manual' + - name: Run manual build steps + if: matrix.build-mode == 'manual' shell: bash run: | - echo 'If you are using a "manual" build mode for one or more of the' \ dotnet build - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.38.2 + uses: github/codeql-action/analyze@v4 with: - category: "/language:${{matrix.language}}" + category: '/language:${{matrix.language}}' diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index 372d0fd..3a47079 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -13,6 +13,9 @@ env: IMAGE_NAME: algorithm-exercises-csharp ARTIFACT_NAME: algorithm-exercises-csharp_${{ github.sha }} +permissions: + contents: read + jobs: build-lint: name: 'Build Docker LINT image' diff --git a/.github/workflows/dotnet-coverage.yml b/.github/workflows/dotnet-coverage.yml index d6f731f..d936a52 100644 --- a/.github/workflows/dotnet-coverage.yml +++ b/.github/workflows/dotnet-coverage.yml @@ -8,17 +8,20 @@ name: dotNET Coverage on: # yamllint disable-line rule:truthy push: - branches: ["main"] + branches: ['main'] pull_request: - branches: ["main"] + branches: ['main'] workflow_dispatch: +permissions: + contents: read + jobs: coverage: - name: "Run Coverage" + name: 'Run Coverage' strategy: fail-fast: false - runs-on: "windows-2025" + runs-on: 'windows-2025' steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Setup .NET diff --git a/.github/workflows/dotnet-lint.yml b/.github/workflows/dotnet-lint.yml index 3692f7a..fb79c21 100644 --- a/.github/workflows/dotnet-lint.yml +++ b/.github/workflows/dotnet-lint.yml @@ -8,27 +8,30 @@ name: dotNET Lint on: # yamllint disable-line rule:truthy push: - branches: ["main"] + branches: ['main'] pull_request: # The branches below must be a subset of the branches above - branches: ["main"] + branches: ['main'] workflow_dispatch: +permissions: + contents: read + jobs: lint: - name: "Run LINT" + name: 'Run LINT' strategy: fail-fast: false matrix: os: - - "windows-2022" - - "windows-2025" - - "ubuntu-24.04" - - "ubuntu-26.04" - - "macos-15" - - "macos-15-intel" - - "macos-26" - - "macos-26-intel" + - 'windows-2022' + - 'windows-2025' + - 'ubuntu-24.04' + - 'ubuntu-26.04' + - 'macos-15' + - 'macos-15-intel' + - 'macos-26' + - 'macos-26-intel' dotnet-version: [8.0.x, 9.0.x, 10.0.x] runs-on: ${{ matrix.os }} steps: diff --git a/.github/workflows/dotnet-test.yml b/.github/workflows/dotnet-test.yml index c399b62..8c154d3 100644 --- a/.github/workflows/dotnet-test.yml +++ b/.github/workflows/dotnet-test.yml @@ -8,27 +8,30 @@ name: dotNET Tests on: # yamllint disable-line rule:truthy push: - branches: ["main"] + branches: ['main'] pull_request: # The branches below must be a subset of the branches above - branches: ["main"] + branches: ['main'] workflow_dispatch: +permissions: + contents: read + jobs: test: - name: "Run Tests" + name: 'Run Tests' strategy: fail-fast: false matrix: os: - - "windows-2022" - - "windows-2025" - - "ubuntu-24.04" - - "ubuntu-26.04" - - "macos-15" - - "macos-15-intel" - - "macos-26" - - "macos-26-intel" + - 'windows-2022' + - 'windows-2025' + - 'ubuntu-24.04' + - 'ubuntu-26.04' + - 'macos-15' + - 'macos-15-intel' + - 'macos-26' + - 'macos-26-intel' dotnet-version: [8.0.x, 9.0.x, 10.0.x] runs-on: ${{ matrix.os }} steps: diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index 26d11ef..f0f9836 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -15,7 +15,11 @@ on: # yamllint disable-line rule:truthy # │ │ │ │ │ # │ │ │ │ │ # * * * * * - - cron: "0 4 * * *" # run once a day at 4 AM + - cron: '0 4 * * *' # run once a day at 4 AM + +permissions: + contents: read + jobs: scan: name: gitleaks diff --git a/.github/workflows/hadolint.yml b/.github/workflows/hadolint.yml index bbaef80..938a354 100644 --- a/.github/workflows/hadolint.yml +++ b/.github/workflows/hadolint.yml @@ -11,10 +11,10 @@ name: Hadolint on: # yamllint disable-line rule:truthy push: - branches: ["main"] + branches: ['main'] pull_request: # The branches below must be a subset of the branches above - branches: ["main"] + branches: ['main'] schedule: - cron: '33 15 * * 3' diff --git a/.github/workflows/make-coverage-html.yml b/.github/workflows/make-coverage-html.yml index 6396710..cf7e3d0 100644 --- a/.github/workflows/make-coverage-html.yml +++ b/.github/workflows/make-coverage-html.yml @@ -7,15 +7,18 @@ name: Make Coverage HTML on: # yamllint disable-line rule:truthy push: - branches: ["main"] + branches: ['main'] pull_request: - branches: ["main"] + branches: ['main'] workflow_dispatch: +permissions: + contents: read + jobs: make-coverage-html: - name: "Run make coverage/html and verify coverage HTML" - runs-on: "windows-2025" + name: 'Run make coverage/html and verify coverage HTML' + runs-on: 'windows-2025' steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Setup .NET diff --git a/.github/workflows/markdown-lint.yml b/.github/workflows/markdown-lint.yml index 54fe76d..ee9811c 100644 --- a/.github/workflows/markdown-lint.yml +++ b/.github/workflows/markdown-lint.yml @@ -3,10 +3,10 @@ name: Markdown Lint on: # yamllint disable-line rule:truthy push: - branches: ["main"] + branches: ['main'] pull_request: # The branches below must be a subset of the branches above - branches: ["main"] + branches: ['main'] workflow_dispatch: env: diff --git a/.github/workflows/prettier-json.yml b/.github/workflows/prettier-json.yml index ae39f1e..ffe9e5c 100644 --- a/.github/workflows/prettier-json.yml +++ b/.github/workflows/prettier-json.yml @@ -3,16 +3,19 @@ name: Prettier JSON Lint on: # yamllint disable-line rule:truthy push: - branches: ["main"] + branches: ['main'] pull_request: # The branches below must be a subset of the branches above - branches: ["main"] + branches: ['main'] workflow_dispatch: +permissions: + contents: read + jobs: json-lint: - name: "Prettier JSON Lint" - runs-on: ["ubuntu-26.04"] + name: 'Prettier JSON Lint' + runs-on: ['ubuntu-26.04'] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 7ef22a0..40a532f 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -3,11 +3,14 @@ name: SonarCloud on: # yamllint disable-line rule:truthy push: - branches: ["main"] + branches: ['main'] pull_request: types: [opened, synchronize, reopened] workflow_dispatch: +permissions: + contents: read + jobs: build: name: Build and analyze @@ -25,7 +28,7 @@ jobs: with: java-version: 25 # Alternative distribution options are available. - distribution: "temurin" + distribution: 'temurin' - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: # Shallow clones should be disabled for a better relevancy of analysis diff --git a/.github/workflows/yamllint.yml b/.github/workflows/yamllint.yml index fa70419..4662c82 100644 --- a/.github/workflows/yamllint.yml +++ b/.github/workflows/yamllint.yml @@ -3,12 +3,15 @@ name: YAML lint on: # yamllint disable-line rule:truthy push: - branches: ["main"] + branches: ['main'] pull_request: # The branches below must be a subset of the branches above - branches: ["main"] + branches: ['main'] workflow_dispatch: +permissions: + contents: read + jobs: lint: name: YAML Lint