.github/workflows/codeql.yml
1
---
2
name: codeql
4
on:
5
push:
6
branches: [main]
7
pull_request:
8
branches: [main]
9
schedule:
10
- cron: "27 5 * * 1"
12
permissions:
13
contents: read
15
concurrency:
16
group: codeql-${{ github.ref }}
17
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
19
jobs:
20
analyze:
21
name: analyze (${{ matrix.language }})
22
runs-on: ubuntu-24.04
23
timeout-minutes: 20
24
permissions:
25
contents: read
26
security-events: write
27
strategy:
28
fail-fast: false
29
matrix:
30
include:
31
- language: go
32
build-mode: autobuild
33
- language: actions
34
build-mode: none
35
- language: javascript-typescript
36
build-mode: none
37
steps:
38
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
39
with:
40
persist-credentials: false
42
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
43
if: matrix.language == 'go'
44
with:
45
go-version-file: go.mod
46
cache: true
48
- name: Initialize CodeQL
49
uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
50
with:
51
languages: ${{ matrix.language }}
52
build-mode: ${{ matrix.build-mode }}
53
queries: security-extended
55
- name: Autobuild
56
if: matrix.build-mode == 'autobuild'
57
uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
59
- name: Analyze
60
uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
61
with:
62
category: /language:${{ matrix.language }}