codeql.yml

name: CodeQL

# Static analysis of the Go code. Runs on pull requests and weekly, so a vulnerability introduced
# by a dependency bump or a refactor is caught even when nobody touches the file again.

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '25 4 * * 2'
  workflow_dispatch:

permissions: {}

jobs:
  analyze:
    name: Analyze Go
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: '1.26.6'
          # No go.sum to key a cache on: the zero-dependency rule keeps this module
          # dependency-free, and a pre-commit hook fails if the file ever
          # appears. Pointing the cache at it warned on every run and never
          # hit, which is a cache that costs and returns nothing.
          cache: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          languages: go
          queries: security-extended

      - name: Build
        run: go build ./...

      - name: Analyze
        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9