selcukhaltas
2 years ago
committed by
GitHub
GitHub
4 changed files with 165 additions and 75 deletions
@ -0,0 +1,72 @@ |
|||
# For most projects, this workflow file will not need changing; you simply need |
|||
# to commit it to your repository. |
|||
# |
|||
# You may wish to alter this file to override the set of languages analyzed, |
|||
# or to provide custom queries or build logic. |
|||
# |
|||
# ******** NOTE ******** |
|||
# We have attempted to detect the languages in your repository. Please check |
|||
# the `language` matrix defined below to confirm you have the correct set of |
|||
# supported CodeQL languages. |
|||
# |
|||
name: "CodeQL" |
|||
|
|||
on: |
|||
push: |
|||
branches: [ "master" ] |
|||
pull_request: |
|||
# The branches below must be a subset of the branches above |
|||
branches: [ "master" ] |
|||
schedule: |
|||
- cron: '43 23 * * 6' |
|||
|
|||
jobs: |
|||
analyze: |
|||
name: Analyze |
|||
runs-on: ubuntu-latest |
|||
permissions: |
|||
actions: read |
|||
contents: read |
|||
security-events: write |
|||
|
|||
strategy: |
|||
fail-fast: false |
|||
matrix: |
|||
language: [ ] |
|||
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] |
|||
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support |
|||
|
|||
steps: |
|||
- name: Checkout repository |
|||
uses: actions/checkout@v3 |
|||
|
|||
# Initializes the CodeQL tools for scanning. |
|||
- name: Initialize CodeQL |
|||
uses: github/codeql-action/init@v2 |
|||
with: |
|||
languages: ${{ matrix.language }} |
|||
# If you wish to specify custom queries, you can do so here or in a config file. |
|||
# By default, queries listed here will override any specified in a config file. |
|||
# Prefix the list here with "+" to use these queries and those in the config file. |
|||
|
|||
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs |
|||
# queries: security-extended,security-and-quality |
|||
|
|||
|
|||
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java). |
|||
# If this step fails, then you should remove it and run the build manually (see below) |
|||
- name: Autobuild |
|||
uses: github/codeql-action/autobuild@v2 |
|||
|
|||
# ℹ️ Command-line programs to run using the OS shell. |
|||
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun |
|||
|
|||
# If the Autobuild fails above, remove it and uncomment the following three lines. |
|||
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. |
|||
|
|||
# - run: | |
|||
# echo "Run, Build Application using script" |
|||
# ./location_of_script_within_repo/buildscript.sh |
|||
|
|||
- name: Perform CodeQL Analysis |
|||
uses: github/codeql-action/analyze@v2 |
|||
@ -0,0 +1,68 @@ |
|||
# This workflow uses actions that are not certified by GitHub. |
|||
# They are provided by a third-party and are governed by |
|||
# separate terms of service, privacy policy, and support |
|||
# documentation. |
|||
|
|||
# This workflow helps you trigger a SonarCloud analysis of your code and populates |
|||
# GitHub Code Scanning alerts with the vulnerabilities found. |
|||
# Free for open source project. |
|||
|
|||
# 1. Login to SonarCloud.io using your GitHub account |
|||
|
|||
# 2. Import your project on SonarCloud |
|||
# * Add your GitHub organization first, then add your repository as a new project. |
|||
# * Please note that many languages are eligible for automatic analysis, |
|||
# which means that the analysis will start automatically without the need to set up GitHub Actions. |
|||
# * This behavior can be changed in Administration > Analysis Method. |
|||
# |
|||
# 3. Follow the SonarCloud in-product tutorial |
|||
# * a. Copy/paste the Project Key and the Organization Key into the args parameter below |
|||
# (You'll find this information in SonarCloud. Click on "Information" at the bottom left) |
|||
# |
|||
# * b. Generate a new token and add it to your Github repository's secrets using the name SONAR_TOKEN |
|||
# (On SonarCloud, click on your avatar on top-right > My account > Security |
|||
# or go directly to https://sonarcloud.io/account/security/) |
|||
|
|||
# Feel free to take a look at our documentation (https://docs.sonarcloud.io/getting-started/github/) |
|||
# or reach out to our community forum if you need some help (https://community.sonarsource.com/c/help/sc/9) |
|||
|
|||
name: SonarCloud analysis |
|||
|
|||
on: |
|||
push: |
|||
branches: [ "master" ] |
|||
pull_request: |
|||
branches: [ "master" ] |
|||
workflow_dispatch: |
|||
|
|||
permissions: |
|||
pull-requests: read # allows SonarCloud to decorate PRs with analysis results |
|||
|
|||
jobs: |
|||
Analysis: |
|||
runs-on: ubuntu-latest |
|||
|
|||
steps: |
|||
- name: Analyze with SonarCloud |
|||
|
|||
# You can pin the exact commit or the version. |
|||
# uses: SonarSource/sonarcloud-github-action@de2e56b42aa84d0b1c5b622644ac17e505c9a049 |
|||
uses: SonarSource/sonarcloud-github-action@de2e56b42aa84d0b1c5b622644ac17e505c9a049 |
|||
env: |
|||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information |
|||
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # Generate a token on Sonarcloud.io, add it to the secrets of this repo with the name SONAR_TOKEN (Settings > Secrets > Actions > add new repository secret) |
|||
with: |
|||
# Additional arguments for the sonarcloud scanner |
|||
args: |
|||
# Unique keys of your project and organization. You can find them in SonarCloud > Information (bottom-left menu) |
|||
# mandatory |
|||
-Dsonar.projectKey= |
|||
-Dsonar.organization= |
|||
# Comma-separated paths to directories containing main source files. |
|||
#-Dsonar.sources= # optional, default is project base directory |
|||
# When you need the analysis to take place in a directory other than the one from which it was launched |
|||
#-Dsonar.projectBaseDir= # optional, default is . |
|||
# Comma-separated paths to directories containing test source files. |
|||
#-Dsonar.tests= # optional. For more info about Code Coverage, please refer to https://docs.sonarcloud.io/enriching/test-coverage/overview/ |
|||
# Adds more detail to both client and server-side analysis logs, activating DEBUG mode for the scanner, and adding client-side environment variables and system properties to the server-side log of analysis report processing. |
|||
#-Dsonar.verbose= # optional, default is false |
|||
@ -1,70 +0,0 @@ |
|||
{ |
|||
"$schema": "https://raw.githubusercontent.com/prototypicalpro/repolinter/master/rulesets/schema.json", |
|||
"version": 2, |
|||
"axioms": {}, |
|||
"rules": { |
|||
"license-file-is-MIT": { |
|||
"level": "warning", |
|||
"rule": { |
|||
"type": "file-contents", |
|||
"options": { |
|||
"globsAll": ["LICENSE*", "COPYING*"], |
|||
"nocase": true, |
|||
"fail-on-non-existant": true, |
|||
"content": "MIT License" |
|||
} |
|||
}, |
|||
"fix": { |
|||
"type": "file-create", |
|||
"options": { |
|||
"file": "LICENSE", |
|||
"replace": true, |
|||
"text": { "url": "https://opensource.org/licenses/MIT" } |
|||
} |
|||
}, |
|||
"policyInfo": "MIT License is required for code or legal approval for an alternative", |
|||
"policyUrl": "https://github.com/github/open-source/blob/main/policies/release.md" |
|||
}, |
|||
"readme-file-exists": { |
|||
"level": "warning", |
|||
"rule": { |
|||
"type": "file-existence", |
|||
"options": { |
|||
"globsAny": ["README*"], |
|||
"nocase": true |
|||
} |
|||
}, |
|||
"fix": { |
|||
"type": "file-create", |
|||
"options": { |
|||
"file": "README.md", |
|||
"text": { "url": "https://raw.githubusercontent.com/newrelic/open-source-tools/master/nerdpacks/oss-template/README.md" } |
|||
} |
|||
}, |
|||
"policyInfo": "GitHub requires a README file in all projects. This README should give a general overview of the project, and should point to additional resources (security, contributing, etc.) where developers and users can learn further", |
|||
"policyUrl": "https://github.com/github/open-source/blob/main/policies/release.md" |
|||
}, |
|||
"codeowners-file-exists": { |
|||
"level": "warning", |
|||
"rule": { |
|||
"type": "file-existence", |
|||
"options": { |
|||
"globsAny": ["CODEOWNERS*", "*/CODEOWNERS*", ".github/CODEOWNERS*"], |
|||
"nocase": true |
|||
} |
|||
}, |
|||
"fix": { |
|||
"type": "file-create", |
|||
"options": { |
|||
"file": "CODEOWNERS", |
|||
"text": { "url": "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners" } |
|||
} |
|||
}, |
|||
"policyInfo": "GitHub requires a CODEOWNERS file in all projects. This enables GitHub to contact the maintainers in the event it is necessary.", |
|||
"policyUrl": "https://github.com/github/open-source/blob/main/policies/release.md" |
|||
}, |
|||
}, |
|||
"formatOptions": { |
|||
"disclaimer": "🤖*This issue was automatically generated by [repolinter-action](https://github.com/newrelic/repolinter-action), developed by the Open Source and Developer Advocacy team at New Relic.*" |
|||
} |
|||
} |
|||
Loading…
Reference in new issue