name: "🔒 CodeQL Analysis"
on:
schedule:
- cron: "0 0 * * 1"
workflow_dispatch:
permissions:
contents: read
jobs:
codeql:
name: 🔒 CodeQL Analysis (Rust)
runs-on: ubuntu-latest
env:
CLICOLOR: 1
SCCACHE_GHA_ENABLED: "true"
RUSTC_WRAPPER: "sccache"
permissions:
actions: read
contents: read
security-events: write
steps:
- name: 🛡️ Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 with:
egress-policy: audit
- name: 📁 Check out the repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: 📦 Set up sccache
uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba with:
disable_annotations: true
- name: 📦 Cache Rust registry
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 with:
shared-key: "codeql"
cache-targets: false
- name: 📦 Restore compiled dependencies
uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 with:
path: target/
key: target-full-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
restore-keys: target-full-${{ runner.os }}-
- name: 🛠️ Set up Rust toolchain
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
- name: 🔒 Initialize CodeQL
uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 with:
languages: rust
- name: 🛠️ Build workspace
run: cargo build --workspace --all-features
- name: 🔒 Perform CodeQL Analysis
uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 with:
category: "/language:rust"