name: Code Scanning

on:

push:

branches: [trunk]

pull_request:

branches: [trunk]

paths-ignore:

- '**/*.md'

schedule:

- cron: "0 0 * * 0"

workflow_dispatch:

permissions:

actions: read # for github/codeql-action/init to get workflow details

contents: read # for actions/checkout to fetch code

security-events: write # for github/codeql-action/analyze to upload SARIF results

jobs:

CodeQL-Build:

runs-on: ubuntu-latest

strategy:

fail-fast: false

matrix:

include:

# Go uses our custom config, which extends `security-and-quality`

# with the project-specific queries under `.github/codeql/queries/`.

# `build-mode: manual` runs our own build below so extraction is scoped

# to the main module and never co-extracts the nested query-test module.

- language: go

build-mode: manual

config-file: ./.github/codeql/codeql-config.yml

# Actions uses the stock `security-and-quality` suite.

- language: actions

build-mode: none

queries: security-and-quality

steps:

- name: Check out code

uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Setup Go

if: matrix.language == 'go'

uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

with:

go-version-file: "go.mod"

- name: Initialize CodeQL

uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

with:

languages: ${{ matrix.language }}

build-mode: ${{ matrix.build-mode }}

config-file: ${{ matrix.config-file }}

queries: ${{ matrix.queries }}

# Mirror the shipped build (see go.yml integration-tests) so the analyzed

# code matches what we release.

- name: Build Go

if: matrix.language == 'go'

run: make

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

with:

category: "/language:${{ matrix.language }}"

upload: false

output: sarif-results

- name: Upload filtered SARIF

uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

with:

sarif_file: sarif-results/${{ matrix.language }}.sarif

category: "/language:${{ matrix.language }}"