ci(build): run the Node and Bun cross-runtime checks from a packed in… #384

	name: "CodeQL"

	on:
	push:
	branches:
	- main

	pull_request:
	branches:
	- main

	schedule:
	- cron: "0 6 * * 1"

	workflow_dispatch:

	concurrency:
	group: ${{ github.ref }}-codeql
	cancel-in-progress: true

	jobs:
	analyze:
	name: Analyze (${{ matrix.language }})
	runs-on: ubuntu-latest
	timeout-minutes: 30

	permissions:
	actions: read
	contents: read
	packages: read
	security-events: write

	strategy:
	fail-fast: false
	matrix:
	include:
	- language: actions
	build-mode: none
	- language: go
	build-mode: autobuild
	- language: javascript-typescript
	build-mode: none

	steps:
	- name: Checkout repository
	uses: actions/checkout@v7
	with:
	fetch-depth: 2

	- name: Setup Go
	if: matrix.language == 'go'
	uses: actions/setup-go@v7
	with:
	# go.mod, not "stable": a new Go minor lands on the runner before the
	# pinned golangci-lint can parse it, and Validate then dies inside
	# staticcheck on the standard library rather than on our code.
	go-version-file: go.mod
	cache-dependency-path: go.sum

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v4
	with:
	languages: ${{ matrix.language }}
	build-mode: ${{ matrix.build-mode }}

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v4
	with:
	category: "/language:${{ matrix.language }}"

Navigation Menu