# SPDX-FileCopyrightText: 2021 The HedgeDoc developers (see AUTHORS file) # # SPDX-License-Identifier: AGPL-3.0-only name: Static Analysis on: push: branches: [ develop ] pull_request: branches: [ develop ] schedule: - cron: '0 7 * * 6' permissions: actions: read contents: read security-events: write jobs: njsscan: runs-on: ubuntu-latest name: Njsscan code scanning steps: - name: Checkout the code uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Scan with njsscan id: njsscan uses: ajinabraham/njsscan-action@74e5a58c1edb363b84c9ddd626b0e22f038ac09e # master with: args: '--sarif --output results.sarif src || true' - name: Upload njsscan report uses: github/codeql-action/upload-sarif@6ca1aa8c195c3ca3e77c174fe0356db1bce3b319 # v2.21.1 with: sarif_file: results.sarif codeql: name: CodeQL analysis runs-on: ubuntu-latest strategy: fail-fast: false matrix: language: [ 'javascript' ] # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] steps: - name: Checkout repository uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - name: Initialize CodeQL uses: github/codeql-action/init@6ca1aa8c195c3ca3e77c174fe0356db1bce3b319 # v2.21.1 with: languages: ${{ matrix.language }} queries: +security-and-quality - name: Autobuild uses: github/codeql-action/autobuild@6ca1aa8c195c3ca3e77c174fe0356db1bce3b319 # v2.21.1 - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@6ca1aa8c195c3ca3e77c174fe0356db1bce3b319 # v2.21.1 with: category: "/language:${{ matrix.language }}"