chore(cursor): add ASCII safety rule and refine shell guidance #2990
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL Advanced" | |
| on: | |
| workflow_dispatch: {} | |
| schedule: | |
| - cron: "0 6 * * 1" # Weekly on Monday at 06:00 UTC | |
| push: | |
| branches: | |
| - "main" | |
| - "release-v*.*" | |
| paths: | |
| - "!docs/**" | |
| - "!deploy/**" | |
| - "!packaging/**" | |
| - "!**.yaml" | |
| - "!**.md" | |
| - "!**.txt" | |
| - "!**.conf" | |
| # override previous rules: | |
| - "go.mod" | |
| - "go.sum" | |
| - "Makefile" | |
| - "**.c" | |
| - "**.h" | |
| - "**.go" | |
| - "**/codeql.yaml" | |
| pull_request: | |
| branches: | |
| - "main" | |
| - "release-v*.*" | |
| permissions: {} | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ${{ vars.UBUNTU_X86_RUNNER_LABEL || (github.repository_owner == 'aquasecurity' && 'ubuntu-24.04') }} | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [c-cpp, go] | |
| include: | |
| - language: c-cpp | |
| build-mode: manual | |
| - language: go | |
| build-mode: manual | |
| goarch: amd64 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libelf-dev clang make gcc pkg-config file | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version: "1.26" | |
| - name: Set Go Environment | |
| if: matrix.language == 'go' | |
| env: | |
| GOARCH_VALUE: ${{ matrix.goarch }} | |
| run: | | |
| echo "GOOS=linux" >> "${GITHUB_ENV}" | |
| echo "GOARCH=${GOARCH_VALUE}" >> "${GITHUB_ENV}" | |
| - name: Update submodules | |
| run: git submodule update --init --recursive | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| queries: security-extended | |
| config: | | |
| paths-ignore: | |
| - 3rdparty | |
| - name: Build C/eBPF objects | |
| if: matrix.language == 'c-cpp' | |
| run: | | |
| make bpf | |
| - name: Build Go | |
| if: matrix.language == 'go' | |
| run: | | |
| make | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 | |
| with: | |
| category: "/language:${{ matrix.language }}" |