Bump the go-runtime group with 3 updates #38

	name: CodeQL

	# Static analysis for the security properties the ordinary suites cannot check.
	# CI proves the code does what the tests say; this looks for the paths nobody
	# wrote a test for.

	on:
	push:
	branches: [main, dev]
	pull_request:
	branches: [main, dev]
	schedule:
	# Weekly, so a newly published query finds an old bug without waiting for
	# someone to happen to push.
	- cron: "17 6 * * 1"

	permissions:
	contents: read

	concurrency:
	group: codeql-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	analyze:
	name: Analyze Go
	runs-on: ubuntu-24.04
	timeout-minutes: 30
	permissions:
	security-events: write
	actions: read
	contents: read
	steps:
	- name: Check out source without persisted credentials
	uses: actions/checkout@v6
	with:
	persist-credentials: false

	- name: Install Go
	uses: actions/setup-go@v6
	with:
	go-version: 1.26.5
	cache: true
	cache-dependency-path: go.sum

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: go
	build-mode: manual
	queries: security-and-quality

	- name: Build
	env:
	GOTOOLCHAIN: local
	run: go build ./...

	- name: Analyze
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:go"

Navigation Menu