codeql-analysis.yml

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
name: "CodeQL"

on:
  schedule:
    - cron: '0 11 * * 6'

permissions:  # added using https://github.com/step-security/secure-repo
  contents: read

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest

    permissions:
      # required for all workflows
      security-events: write
      # only required for workflows in private repositories
      actions: write
      contents: read

    steps:
    -
      name: Harden Runner
      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
      with:
        disable-sudo: true
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          github.com:443
          go.dev:443
          golang.org:443
          storage.googleapis.com:443
    -
      name: Cancel previous workflows
      uses: styfle/cancel-workflow-action@01ce38bf961b4e243a6342cbade0dbc8ba3f0432 # 0.12.0
      with:
        access_token: ${{ secrets.GITHUB_TOKEN }}
    - name: Checkout repository
      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
      with:
        # We must fetch at least the immediate parents so that if this is
        # a pull request then we can checkout the head.
        fetch-depth: 2

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@ccf74c947955fd1cf117aef6a0e4e66191ef6f61 # v3.25.4
      with:
        languages: go
    -
      name: Set up Go
      uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
      with:
        go-version: "1.22"
    -
      name: Build Harp
      run: |
        go mod vendor && go build -mod=vendor -o bin/harp zntr.io/harp/v2/cmd/harp
      env:
        DOCKERFILE_ONLY: 1
        GOLANG_IMAGE: ${{ matrix.golang-image }}
        GOLANG_VERSION: ${{ matrix.golang-version }}
        TOOL_IMAGE_NAME: ${{ matrix.tools-image }}
        RELEASE: ${{ github.event.inputs.release }}

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@ccf74c947955fd1cf117aef6a0e4e66191ef6f61 # v3.25.4