Repository navigation
research: publish canonical pilot v1 dataset and analysis #381
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: codeql | |
| # Static analysis for the Go code (cmd/, internal/) via GitHub CodeQL. | |
| # build-mode: none analyzes the source directly, so this does not need the | |
| # C/libbpf validator toolchain. Results surface under Security > Code scanning. | |
| # | |
| # Security note: no untrusted ${{ github.event.* }} value is interpolated into | |
| # any run: shell here, so workflow-injection via PR titles/branches does not | |
| # apply to this file. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "27 4 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze (Go) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.25.14" | |
| cache: true | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 | |
| with: | |
| languages: go | |
| # Go does not support build-mode: none; autobuild runs `go build`, | |
| # which needs no C/libbpf toolchain (the validator is a separate | |
| # non-Go component). | |
| build-mode: autobuild | |
| queries: security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 | |
| with: | |
| category: "/language:go" | |
| - name: Enforce zero open production-boundary alerts | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: bash scripts/check-production-code-scanning.sh "$GITHUB_REPOSITORY" "$GITHUB_REF" |