# Analyzes the code using GitHub's default CodeQL query database. # Identified issues are registered with GitHub's code scanning dashboard. When # a pull request is analyzed, any offending lines are annotated. See # https://codeql.github.com for details. name: CodeQL analysis on: pull_request: push: branches: [ master ] schedule: - cron: '0 4 * * 1' permissions: contents: read jobs: analyze: strategy: matrix: language: [ java, ruby ] permissions: contents: read security-events: write runs-on: ubuntu-22.04 steps: - name: Install Harden-Runner uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 with: disable-sudo: true egress-policy: block allowed-endpoints: > api.github.com:443 github.com:443 repo.maven.apache.org:443 - name: Check out code and set up JDK and Maven uses: s4u/setup-maven-action@6d44c18d67d9e1549907b8815efa5e4dada1801b # v1.12.0 with: java-version: 17.0.10 java-distribution: temurin maven-version: 3.9.6 - name: Initialize CodeQL uses: github/codeql-action/init@47b3d888fe66b639e431abf22ebca059152f1eea # v3.24.5 with: languages: ${{ matrix.language }} - name: Perform minimal build if: matrix.language == 'java' run: mvn -T1C clean package -DskipTests -Dverification.skip - name: Perform CodeQL analysis uses: github/codeql-action/analyze@47b3d888fe66b639e431abf22ebca059152f1eea # v3.24.5 with: category: /language:${{ matrix.language }}