You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dolphinscheduler.apache.org by ke...@apache.org on 2022/09/03 14:04:04 UTC
[dolphinscheduler] 01/01: Add codeql to scan codes
This is an automated email from the ASF dual-hosted git repository.
kezhenxu94 pushed a commit to branch codeql
in repository https://gitbox.apache.org/repos/asf/dolphinscheduler.git
commit 77cf06590048ebd9e9d71bab7ea4b780ecf1883d
Author: kezhenxu94 <ke...@apache.org>
AuthorDate: Sat Sep 3 22:03:51 2022 +0800
Add codeql to scan codes
---
.github/workflows/codeql.yaml | 58 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 58 insertions(+)
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
new file mode 100644
index 0000000000..859f38ec90
--- /dev/null
+++ b/.github/workflows/codeql.yaml
@@ -0,0 +1,58 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "CodeQL"
+
+on:
+ push:
+ branches:
+ - 'dev'
+ - 'codeql'
+ pull_request:
+ branches:
+ - 'dev'
+
+concurrency:
+ group: codeql-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ analyze:
+ if: (github.event_name == 'schedule' && github.repository == 'apache/dolphinscheduler') || (github.event_name != 'schedule')
+ name: Analyze
+ runs-on: ubuntu-latest
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v3
+ with:
+ submodules: true
+
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v2
+ with:
+ languages: java
+ queries: +security-and-quality
+
+ - run: |
+ ./mvnw -B clean install \
+ -Dmaven.test.skip \
+ -Dmaven.javadoc.skip \
+ -Dcheckstyle.skip=true \
+ -Prelease
+
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v2