refactor(audit): ask one booted GitLab both halves of the shape question #1116
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CodeQL code scanning (advanced setup). | |
| # | |
| # Replaces GitHub's default setup so the Go job can install the toolchain the | |
| # module requires: the default-setup environment pins GOTOOLCHAIN=local to the | |
| # runner's Go, which breaks every time go.mod moves to a Go version the CodeQL | |
| # runtime has not shipped yet (first hit: Go 1.27.0, 2026-08). Coverage | |
| # mirrors what default setup analyzed: actions, go, javascript-typescript, | |
| # with the default query suite and a weekly scheduled scan. | |
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| # No branches filter: stacked PRs get analyzed too (see ci.yml). | |
| pull_request: | |
| schedule: | |
| - cron: "26 14 * * 2" | |
| # Separate group from ci.yml so a cancelled CI run never cancels an | |
| # in-flight security analysis (and vice versa). | |
| concurrency: | |
| group: codeql-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: "🔐 CodeQL (${{ matrix.language }})" | |
| runs-on: ubuntu-latest | |
| # The Go analysis is the long one, about six minutes: three of building | |
| # every package for the extractor and two of analysis. A hung extractor | |
| # must not hold a runner for the six-hour default. | |
| timeout-minutes: 20 | |
| permissions: | |
| security-events: write | |
| packages: read | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: actions | |
| build-mode: none | |
| - language: go | |
| build-mode: manual | |
| - language: javascript-typescript | |
| build-mode: none | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| if: matrix.language == 'go' | |
| with: | |
| go-version-file: go.mod | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| # Manual build keeps the Go extractor on the setup-go toolchain instead | |
| # of autobuild's environment probing; compiling every package (tests | |
| # included via the e2e tag set elsewhere) is enough for extraction. | |
| - name: Build Go | |
| if: matrix.language == 'go' | |
| run: | | |
| go mod download | |
| go build ./... | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4 | |
| with: | |
| category: "/language:${{ matrix.language }}" |