From e3de3e7175cee51dcec82bf02c1c40672dce6ff8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Torbj=C3=B8rn=20B=C3=B8e=20Lauvvik?= Date: Tue, 10 Nov 2026 14:58:00 +0100 Subject: [PATCH] ci: add CodeQL analysis (shared workflow) Adds CodeQL code scanning through the shared reusable workflow in OriginAS/origin-actions (push to the default branch, pull requests, monthly schedule, manual dispatch). security-events: write is granted only to the analyze job. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/codeql.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..877b365 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,29 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + schedule: + - cron: '0 5 1 * *' # monthly, 1st at 05:00 UTC + workflow_dispatch: + +concurrency: + group: codeql-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + analyze: + # Without the event_name check the job is skipped on push/schedule: + # github.event.pull_request.draft is null there. + if: github.event_name != 'pull_request' || github.event.pull_request.draft == false + permissions: + actions: read + contents: read + security-events: write + uses: OriginAS/origin-actions/.github/workflows/codeql.yml@main + secrets: inherit