meterlogger/.github/workflows/codeql.yml at master · yottabytesolutions/meterlogger · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: CodeQL

# Replaces CodeQL default setup. Both of them: Settings has a Code security
# default setup and a separate Code quality default setup, and each one spawns
# its own CodeQL run. Both are now off, and both are replaced by this workflow.
#
# They pin their own Go toolchain and run the extractor with GOTOOLCHAIN=local,
# so neither can build a module whose go directive is newer than the bundle.
# Driving CodeQL here lets setup-go install the toolchain go.mod asks for, so a
# Go bump never blocks code scanning.
#
# Their runs are titled "Code Quality: ..." and "PR #N" in the Actions list and
# have event "dynamic". If one reappears, a default setup got re-enabled in
# Settings; neither is fully manageable over the REST API.

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
  schedule:
    # Weekly, Tuesday 05:44 UTC. Off the top of the hour and off the Security
    # workflow's Monday slot.
    - cron: '44 5 * * 2'
  # On demand, so a scanning change can be verified green without pushing a
  # commit to trigger it.
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      # Uploading results to the code scanning API.
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: go
            build-mode: manual
          - language: actions
            build-mode: none
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up Go
        if: matrix.language == 'go'
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version-file: go.mod

      - name: Initialize CodeQL
        uses: github/codeql-action/init@c16c0f3f2812ec4bb3750a5ed64873fe2ce0fbef  # codeql-bundle-v2.26.3
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          # Matches the query suite and threat model the previous default
          # setup ran with.
          queries: security-extended

      - name: Build
        if: matrix.build-mode == 'manual'
        run: go build ./...

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@c16c0f3f2812ec4bb3750a5ed64873fe2ce0fbef  # codeql-bundle-v2.26.3
        with:
          category: /language:${{ matrix.language }}