chore(deps): update all Go dependencies; repair pre-commit chain (#661) #377

	name: CodeQL

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: '30 4 * * 1'

	permissions: {}

	jobs:
	codeql:
	uses: netresearch/.github/.github/workflows/codeql.yml@main
	with:
	# Explicit go + javascript-typescript. This repo has a plain-JS
	# frontend (internal/web/static/js/v2-*.js) but no package.json, so
	# the reusable's `auto` detects only go and never scans the JS —
	# GitHub then keeps expecting a JavaScript CodeQL result the
	# code_scanning gate never receives, blocking every PR. Listing JS
	# explicitly produces that result and closes a real coverage gap.
	languages: go,javascript-typescript
	# *_templ.go is gitignored, so the autobuilder fails to extract
	# internal/web and internal/web/templates without this — the
	# standalone CodeQL aggregator then returns NEUTRAL and the
	# `code_scanning` ruleset blocks merges. CLI version is
	# resolved from go.mod (same pattern as ci.yml).
	pre-build-cmd-go: \|
	go install github.com/a-h/templ/cmd/templ@"$(go list -m -f '{{.Version}}' github.com/a-h/templ)"
	# `go install` drops binaries into $(go env GOPATH)/bin, which
	# is not on PATH for the bash shell the reusable codeql.yml
	# spawns. Same workaround as container.yml.
	export PATH="$(go env GOPATH)/bin:${PATH}"
	templ generate
	permissions:
	contents: read
	security-events: write
	actions: read

Navigation Menu