ci(deps): bump the github-actions group across 1 directory with 4 upd… #40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # © 2026 NetApp, Inc. All Rights Reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # See the NOTICE file in the repo root for trademark and attribution details. | |
| name: CodeQL | |
| # Static analysis for the two compiled/interpreted languages in the repo. | |
| # Ansible and Terraform are not CodeQL-supported languages; their checks live | |
| # in validate-examples.yml. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "27 4 * * 1" | |
| permissions: | |
| contents: read | |
| jobs: | |
| analyze: | |
| name: Analyze (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: python | |
| build-mode: none | |
| # Go's module lives at go/go.mod (not the repo root), so CodeQL's | |
| # autobuilder can't discover it on its own — hence "Go files were | |
| # found but not processed" under Default Setup. build-mode: manual | |
| # plus the explicit `go build ./...` step below (scoped to go/) | |
| # fixes that. | |
| - language: go | |
| build-mode: manual | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Go | |
| if: matrix.language == 'go' | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go/go.mod | |
| cache-dependency-path: go/go.mod | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| # Only Go needs an explicit build (build-mode: manual); Python is | |
| # interpreted (build-mode: none) and skips this step entirely. | |
| - name: Build Go module | |
| if: matrix.language == 'go' | |
| working-directory: go | |
| run: go build ./... | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 | |
| with: | |
| category: "/language:${{ matrix.language }}" |