CodeQL #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL" | |
| on: | |
| workflow_call: | |
| schedule: | |
| - cron: '31 6 * * 1' | |
| # See https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions | |
| permissions: # added using https://github.com/step-security/secure-workflows | |
| contents: read | |
| jobs: | |
| codeql-analyze: | |
| # Skip merge_group to avoid duplicate runs (code already scanned on pull_request) | |
| # See https://github.com/github/codeql-action/issues/1537 | |
| if: ${{ github.event_name != 'merge_group' }} | |
| name: CodeQL Analyze | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'go', 'python' ] | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 | |
| with: | |
| submodules: true | |
| - name: Setup Go | |
| if: matrix.language == 'go' | |
| uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version: 1.26.x | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # Use Autobuild for Python (it works fine for interpreted languages) | |
| - name: Autobuild (Python) | |
| if: matrix.language == 'python' | |
| uses: github/codeql-action/autobuild@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0 | |
| # Explicit build for Go - required for CodeQL to analyze compiled code | |
| - name: Build Go code | |
| if: matrix.language == 'go' | |
| run: | | |
| # Build all Go binaries to ensure CodeQL can analyze them | |
| go build -v ./... | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0 |