sec-codeql.yml

name: Security - CodeQL

on:
  push:
    branches: [ main ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ main ]
  schedule:
    - cron: '11 0 * * 5'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  analyze:
    name: Analyze Code
    permissions:
      security-events: write
      actions: read
      contents: read
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4
      with:
        go-version-file: go.mod
        cache: false
    - name: Setup Golang Caches
      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3
      with:
        path: |
          ~/.cache/go-build
          ~/go/pkg/mod
        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
        restore-keys: |
          ${{ runner.os }}-go-
    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@04daf014b50eaf774287bf3f0f1869d4b4c4b913 # v2
      with:
        languages: go
    # Autobuild attempts to build any compiled languages.
    - name: Autobuild
      uses: github/codeql-action/autobuild@04daf014b50eaf774287bf3f0f1869d4b4c4b913 # v2
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@04daf014b50eaf774287bf3f0f1869d4b4c4b913 # v2