copy workflows from blueapi, [still need to configure env values -not a code change] #664
Conversation
stan-dot
added
enhancement
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
stan-dot
force-pushed
the
662-add-codeql-and-sonarcloud-steps-to-the-ci
branch
from
8562d66 to
5f9ea2e
Compare
stan-dot
force-pushed
the
662-add-codeql-and-sonarcloud-steps-to-the-ci
branch
from
959cad1 to
cfe48a3
Compare
|
thanks for the comments @coretl . I deleted the 'if swift language' branches, kept the comments though to keep this more similar to the template workflow for codeql. now sure fully about the syntax in the periodic file though |
sonar-project.properties
Outdated
.github/workflows/_codeql.yaml
Outdated
| # If the analyze step fails for one of the languages you are analyzing with | ||
| # "We were unable to automatically build your code", modify the matrix above | ||
| # to set the build mode to "manual" for that language. Then modify this step | ||
| # to build your code. |
There was a problem hiding this comment.
Please remove comments that are not relevant and this manual mode
| secrets: | ||
| codeql_token: | ||
| description: "Token for CodeQL" | ||
| required: true |
There was a problem hiding this comment.
Where is this token used? Isn't it just the GH token?
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze (${{ matrix.language }}) |
| languages: ${{ matrix.language }} | ||
| build-mode: ${{ matrix.build-mode }} |
There was a problem hiding this comment.
this is for it we were using multiple languages
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/running-variations-of-jobs-in-a-workflow#using-a-matrix-strategy
There was a problem hiding this comment.
and we have the strategy using matrix on lines 34...
There was a problem hiding this comment.
Ok, but as there is a single entry in the matrix I suggest you remove it and put the variables here
There was a problem hiding this comment.
this was the template provided, isn't just simpler to keep it?
There was a problem hiding this comment.
Personal preference. My opinion is that people will read the code a lot more often than write the code. The template's job is to tell us how to make a maximally complicated example work. Our job is to take the bits we want out of it and make an understandable blob of YAML that reads legibly. I would suggest removing the single item matrix as it gets in the way of doing this.
| with: | ||
| codeql: "Check codeql setup" |
| codeql: | ||
| description: "Specify the trigger type" | ||
| required: true | ||
| type: string | ||
| default: "push" |
@