Update version #33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| pull_request: | |
| branches: ["main"] | |
| push: | |
| branches: ["main"] | |
| schedule: | |
| - cron: "17 4 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| actions: read | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyser (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: javascript-typescript | |
| build-mode: none | |
| - language: python | |
| build-mode: none | |
| steps: | |
| - name: Cloner le depot | |
| uses: actions/checkout@v4 | |
| - name: Initialiser CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| queries: +security-and-quality | |
| - name: Executer l'analyse CodeQL | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| output: codeql-results | |
| upload: never | |
| - name: Echouer si CodeQL trouve des alertes | |
| run: | | |
| python - <<'PY' | |
| import json | |
| import pathlib | |
| import sys | |
| sarif_files = sorted(pathlib.Path("codeql-results").glob("*.sarif")) | |
| if not sarif_files: | |
| print("Aucun fichier SARIF CodeQL trouve.") | |
| sys.exit(1) | |
| findings = [] | |
| for sarif_file in sarif_files: | |
| data = json.loads(sarif_file.read_text(encoding="utf-8")) | |
| for run in data.get("runs", []): | |
| rules = { | |
| rule.get("id"): rule | |
| for rule in run.get("tool", {}).get("driver", {}).get("rules", []) | |
| } | |
| for result in run.get("results", []): | |
| rule_id = result.get("ruleId", "unknown-rule") | |
| rule = rules.get(rule_id, {}) | |
| message = result.get("message", {}).get("text") or rule.get("shortDescription", {}).get("text", "") | |
| location = result.get("locations", [{}])[0].get("physicalLocation", {}) | |
| artifact = location.get("artifactLocation", {}).get("uri", "unknown-file") | |
| region = location.get("region", {}) | |
| line = region.get("startLine", 1) | |
| findings.append((rule_id, artifact, line, message)) | |
| if not findings: | |
| print("CodeQL n'a trouve aucune alerte.") | |
| sys.exit(0) | |
| print(f"CodeQL a trouve {len(findings)} alerte(s):") | |
| for rule_id, artifact, line, message in findings[:50]: | |
| print(f"- {rule_id}: {artifact}:{line} - {message}") | |
| if len(findings) > 50: | |
| print(f"... {len(findings) - 50} alerte(s) supplementaire(s).") | |
| sys.exit(1) | |
| PY | |
| - name: Archiver les resultats SARIF | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: codeql-sarif-${{ matrix.language }} | |
| path: codeql-results |