.github/workflows/codeql.yml - main - rinter/1c-kafka-postgres

.github/workflows/codeql.yml
59 строк2 KB
rinter
fix: avoid keeping 1c demo seed connection alive
17 июл 2026, 11:03
17 июл 2026, 11:03724be7e
name: CodeQL

on:
  push:
    branches:
      - main
      - master
      - develop
  pull_request:
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  code-security-mock:
    name: Code security mock
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run compile and security contract checks
        run: |
          python -m compileall integration-service consumer-service tests ci
          python ci/secret_scan.py
          python - <<'PY'
          from pathlib import Path
          checks = {
              'consumer manual commit': '"enable.auto.commit": False' in Path('consumer-service/consumer.py').read_text(encoding='utf-8'),
              'stale update guard': 'EXCLUDED.source_updated_at >= counterparties.source_updated_at' in Path('consumer-service/db.py').read_text(encoding='utf-8'),
              'advisory lock': 'acquire_sync_lock' in Path('integration-service/main.py').read_text(encoding='utf-8'),
              'no weak placeholders': ('change' + 'me') not in Path('.env.example').read_text(encoding='utf-8'),
          }
          failed = [name for name, ok in checks.items() if not ok]
          assert not failed, failed
          print('Code security mock passed:', ', '.join(checks))
          PY

  codeql-live:
    name: CodeQL Python analysis (manual compatible runner)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Mock CodeQL on GitVerse push
        if: ${{ github.event_name != 'workflow_dispatch' }}
        run: |
          echo "GitVerse push uses successful CodeQL mock; real CodeQL runs via manual workflow_dispatch on compatible runner."
          python -m compileall integration-service consumer-service tests ci
      - name: Initialize CodeQL
        if: ${{ github.event_name == 'workflow_dispatch' }}
        uses: github/codeql-action/init@v3
        with:
          languages: python
      - name: Perform CodeQL analysis
        if: ${{ github.event_name == 'workflow_dispatch' }}
        uses: github/codeql-action/analyze@v3