jamiemagee/Scan Nix code with codeql-nix
Run the codeql-nix extractor and queries, then upload SARIF to GitHub code scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| source-root | Directory containing the Nix code to scan. | no | . |
| query-suite | CodeQL query suite to run. One of: - "code-scanning" (default) — the curated codeql-nix security/correctness suite - "code-quality" — the nixpkgs-hammering-style style/quality lints - a path to a .qls file - a single .ql file | no | code-scanning |
| enable-quality | If "true", also runs the `code-quality` suite (Phase 3a nixpkgs-hammering ports). Findings from both suites are uploaded to the same SARIF file under the same category. Default is "false" so existing pipelines see no change. | no | false |
| category | SARIF category used to disambiguate analyses in the Security tab. | no | codeql-nix |
| version | Version of codeql-nix to use (a `vX.Y.Z` tag, or `latest`). | no | latest |
| upload | Whether to upload SARIF to GitHub code scanning. | no | true |
| output | Path to write the SARIF file to (default: ./codeql-nix-results.sarif). | no | codeql-nix-results.sarif |
Outputs
| name | description |
|---|---|
| sarif-file | Path of the produced SARIF file. |