This is an automated email from the ASF dual-hosted git repository. erisu pushed a commit to branch chore/more-workflow-changes in repository https://gitbox.apache.org/repos/asf/cordova-browser.git
commit 0829b78c464d5677e2bc898465d17c8500e68d86 Author: Erisu <[email protected]> AuthorDate: Thu Aug 27 15:15:04 2026 +0900 chore(workflow): split out codeql job --- .github/workflows/ci.yml | 54 ++++++++++++++++++++++++++++++------------------ 1 file changed, 34 insertions(+), 20 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ac75c31..77bc229 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,16 +25,46 @@ on: branches: - '*' -permissions: - contents: read - security-events: write - jobs: + codeql: + name: CodeQL Analysis + + runs-on: ubuntu-latest + + permissions: + contents: read + security-events: write + + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + fetch-depth: 1 + + # "templates/www/cordova.js" is ignored because it is a generated file. + # It contains mixed content from the npm package "cordova-js" and "./cordova-js-src". + # The report might not be resolvable because of the external package. + # If the report is related to this repository, it would be detected when scanning "./cordova-js-src". + - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + with: + languages: javascript + queries: security-and-quality + config: | + paths-ignore: + - coverage + - node_modules + - templates/www/cordova.js + + - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 + test: name: NodeJS ${{ matrix.node-version }} on ${{ matrix.os }} runs-on: ${{ matrix.os }} + permissions: + contents: read + strategy: matrix: node-version: [20.x, 22.x, 24.x] @@ -55,28 +85,12 @@ jobs: node --version npm --version - # "templates/www/cordova.js" is ignored because it is a generated file. - # It contains mixed content from the npm package "cordova-js" and "./cordova-js-src". - # The report might not be resolvable because of the external package. - # If the report is related to this repository, it would be detected when scanning "./cordova-js-src". - - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 - with: - languages: javascript - queries: security-and-quality - config: | - paths-ignore: - - coverage - - node_modules - - templates/www/cordova.js - - name: npm install and test run: | npm cit env: CI: true - - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 - - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 if: success() with: --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
