Merge pull request #22 from devonartis/chore/spdx-headers-polyform #29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Runs CodeQL static analysis for Go on every push and PR against develop | |
| # and main, plus a weekly full run every Monday. SARIF uploads to GitHub | |
| # Code Scanning which is free on public repos. This workflow was parked | |
| # under `workflow_dispatch:` while the repo was private (GHAS would have | |
| # been required) — re-enabled 2026-04-12 after the public flip (TD-VUL-006). | |
| on: | |
| pull_request: | |
| branches: [develop, main] | |
| push: | |
| branches: [develop, main] | |
| schedule: | |
| - cron: '0 6 * * 1' # weekly Monday 06:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| analyze: | |
| name: analyze | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [go] | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: go.mod | |
| - uses: github/codeql-action/init@f94817b9f0deeb3871261446912ae8f854d1b675 # codeql-bundle-v2.25.1 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| - uses: github/codeql-action/autobuild@f94817b9f0deeb3871261446912ae8f854d1b675 # codeql-bundle-v2.25.1 | |
| - uses: github/codeql-action/analyze@f94817b9f0deeb3871261446912ae8f854d1b675 # codeql-bundle-v2.25.1 | |
| with: | |
| category: "/language:${{ matrix.language }}" |