name: "CodeQL" on: push: branches: [ main, develop ] pull_request: branches: [ main, develop ] schedule: - cron: '0 6 * * 1' # Weekly Monday 6am UTC permissions: contents: read actions: read defaults: run: shell: bash jobs: analyze: name: Analyze (${{ matrix.language }}) runs-on: ubuntu-latest permissions: security-events: write contents: read actions: read packages: read strategy: fail-fast: false matrix: include: - language: go build-mode: autobuild - language: javascript-typescript build-mode: none - language: actions build-mode: none steps: - name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - name: Set up Go if: matrix.language == 'go' uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version: '1.26.5' cache: false - name: Set up Node.js if: matrix.language == 'go' uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24' registry-url: 'https://npm.pkg.github.com' cache: 'npm' cache-dependency-path: ui/package-lock.json - name: Build UI assets if: matrix.language == 'go' env: NODE_AUTH_TOKEN: ${{ github.token }} run: cd ui && npm ci && npm run build - name: Initialize CodeQL uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: category: "/language:${{ matrix.language }}"