Repository navigation
CodeQL Security Analysis #370
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================ | |
| # CodeQL Security Analysis | |
| # ============================================================================ | |
| # Performs static analysis for security vulnerabilities using GitHub CodeQL. | |
| # Scans Java (microservices) and JavaScript/TypeScript (frontend) code. | |
| # ============================================================================ | |
| name: CodeQL Security Analysis | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| schedule: | |
| # Run every Wednesday at 04:00 UTC | |
| - cron: "0 4 * * 3" | |
| # concurrency: | |
| # group: ${{ github.workflow }}-${{ github.ref }} | |
| # cancel-in-progress: true | |
| jobs: | |
| # ── CodeQL Analysis — Java (Backend) ────────────────────────────────────── | |
| analyze-java: | |
| name: CodeQL — Java Microservices | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v5 | |
| with: | |
| java-version: "21" | |
| distribution: temurin | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: java | |
| queries: security-and-quality | |
| - name: Build Java modules | |
| run: mvn -B -ntp clean compile -DskipTests | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:java" | |
| # ── CodeQL Analysis — JavaScript/TypeScript (Frontend) ──────────────────── | |
| analyze-javascript: | |
| name: CodeQL — JavaScript/TypeScript Frontend | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: javascript-typescript | |
| queries: security-and-quality | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v4 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:javascript-typescript" | |