From 6c888ca2c2160b606157418d9d3570a2a1ddf883 Mon Sep 17 00:00:00 2001 From: Oliver Wolff <23139298+cuioss@users.noreply.github.com> Date: Tue, 7 Jul 2026 16:37:19 +0200 Subject: [PATCH] ci: add centralized CodeQL workflow and README status badge Add .github/workflows/codeql.yml delegating to the cuioss-organization reusable CodeQL workflow (reusable-codeql.yml @ v0.7.0), matching the other centralized security/CI workflows in this repo. Runs on push/PR to main and weekly; languages java, build-mode none (source analysis, no build needed for this zero-dependency library). Add a CodeQL status badge to the README Status section, in the existing badge style and next to the Maven CI badge (mirrors cui-http PR #82, F-16). Co-Authored-By: Claude --- .github/workflows/codeql.yml | 27 +++++++++++++++++++++++++++ README.adoc | 1 + 2 files changed, 28 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..2c49d9da --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,27 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: '27 4 * * 3' + +permissions: + contents: read + +jobs: + analyze: + # Centralized in cuioss-organization, matching every other security/CI workflow in this repo. + # The reusable workflow fixes the query suite to +security-and-quality org-wide; + # build-mode: none analyses the sources directly (no Maven build needed for this + # zero-dependency library). + uses: cuioss/cuioss-organization/.github/workflows/reusable-codeql.yml@181cc6a24d4c2b6fe7378b9ac94ac3df4665de7b # v0.7.0 + permissions: + security-events: write + contents: read + actions: read + with: + languages: '["java"]' + build-mode: none diff --git a/README.adoc b/README.adoc index 325392bb..9f27f6a4 100644 --- a/README.adoc +++ b/README.adoc @@ -3,6 +3,7 @@ == Status image:https://github.com/cuioss/cui-java-tools/actions/workflows/maven.yml/badge.svg[Java CI with Maven,link=https://github.com/cuioss/cui-java-tools/actions/workflows/maven.yml] +image:https://github.com/cuioss/cui-java-tools/actions/workflows/codeql.yml/badge.svg[CodeQL,link=https://github.com/cuioss/cui-java-tools/actions/workflows/codeql.yml] image:http://img.shields.io/:license-apache-blue.svg[License,link=http://www.apache.org/licenses/LICENSE-2.0.html] image:https://img.shields.io/maven-central/v/de.cuioss/cui-java-tools.svg?label=Maven%20Central["Maven Central", link="https://central.sonatype.com/artifact/de.cuioss/cui-java-tools"]