sec-codeql.yml

name: Security - CodeQL

on:
  push:
    branches: [ main ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ main ]
  schedule:
    - cron: '11 0 * * 5'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze Code
    permissions:
      security-events: write
      actions: read
      contents: read
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4
      with:
        go-version-file: go.mod
        cache: false
    - name: Setup Golang Caches
      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
      with:
        path: |
          ~/.cache/go-build
          ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-
    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@5b62e7a9f186342c830e01bc69a4626fd1573b6e # v2
      with:
        languages: go
    # Autobuild attempts to build any compiled languages.
    - name: Autobuild
      uses: github/codeql-action/autobuild@5b62e7a9f186342c830e01bc69a4626fd1573b6e # v2
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@5b62e7a9f186342c830e01bc69a4626fd1573b6e # v2