diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index e549f93..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,61 +0,0 @@ -# CodeQL static analysis for Swift + JavaScript/TypeScript. - -name: CodeQL - -on: - push: - branches: [develop, main, "rc/*", "release/*"] - pull_request: - branches: [develop, main] - schedule: - - cron: "0 9 * * 1" - -concurrency: - group: codeql-${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - security-events: write - -jobs: - analyze: - name: Analyze ${{ matrix.language }} - runs-on: ${{ matrix.language == 'swift' && 'macos-15' || 'ubuntu-latest' }} - strategy: - fail-fast: false - matrix: - include: - - language: javascript-typescript - build-mode: none - - language: swift - build-mode: manual - steps: - - uses: actions/checkout@v4 - - - name: Select Xcode (swift) - if: matrix.language == 'swift' - run: sudo xcode-select -s /Applications/Xcode_16.app/Contents/Developer || sudo xcode-select -s /Applications/Xcode.app/Contents/Developer - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: ${{ matrix.language }} - build-mode: ${{ matrix.build-mode }} - queries: security-extended - - # CodeQL needs a manual Swift build. We build a representative subset - # of packages (Bus, AgentCore, MCP) so the security lane stays cheap; - # extending to all 14 packages would dominate the CI budget. - - name: Build Swift (CodeQL extraction) - if: matrix.language == 'swift' - run: | - swift build --package-path packages/Bus - swift build --package-path packages/AgentCore - swift build --package-path packages/MCP - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:${{ matrix.language }}"