CodeQL #549
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| # Weekly deep scan only. CodeQL (cross-function SAST) is intentionally NOT run | |
| # per-PR or per-push: this removes pre-merge and per-merge SAST entirely. The | |
| # only remaining code-level SAST is this weekly scan + manual dispatch. Per-PR | |
| # CI still runs osv-scanner (dependency CVEs) — that is SCA, not SAST. Detection | |
| # latency for newly introduced code-level vulnerabilities is up to ~7 days; | |
| # findings land in the Security tab. | |
| schedule: | |
| - cron: "0 6 * * 1" # Mondays 06:00 UTC | |
| workflow_dispatch: | |
| permissions: {} | |
| concurrency: | |
| group: codeql-${{ github.workflow }}-${{ github.sha }} | |
| cancel-in-progress: false | |
| jobs: | |
| analyze: | |
| uses: Mininglamp-OSS/.github/.github/workflows/reusable-codeql.yml@v1 | |
| with: | |
| language: go | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write |