chore(deps): golang.org/x/text (minor → v0.40.0) [third_party/rgo] #769
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Unless explicitly stated otherwise all files in this repository are licensed under | |
| # the Apache 2.0 License. | |
| # | |
| # This product includes software developed at Datadog | |
| # (https://www.datadoghq.com/) Copyright 2025-Present Datadog, Inc. | |
| name: Security | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - "feature/**" | |
| schedule: | |
| - cron: "23 4 * * 1" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Mirror the CI workflow's docs-only gate so markdown-only PR updates do not | |
| # rerun repository security scans while still producing completed checks. | |
| changes: | |
| timeout-minutes: 5 | |
| runs-on: ubuntu-latest | |
| outputs: | |
| docs_only: ${{ steps.classify.outputs.docs_only }} | |
| run_full_ci: ${{ steps.classify.outputs.run_full_ci }} | |
| steps: | |
| - name: Checkout | |
| if: ${{ github.event_name != 'schedule' }} | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Classify changed files | |
| id: classify | |
| shell: bash | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PUSH_BEFORE_SHA: ${{ github.event.before }} | |
| PUSH_AFTER_SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "${EVENT_NAME}" == "schedule" ]]; then | |
| { | |
| echo "docs_only=false" | |
| echo "run_full_ci=true" | |
| } >> "${GITHUB_OUTPUT}" | |
| exit 0 | |
| fi | |
| case "${EVENT_NAME}" in | |
| pull_request) | |
| base_sha="${PR_BASE_SHA}" | |
| head_sha="${PR_HEAD_SHA}" | |
| ;; | |
| push) | |
| base_sha="${PUSH_BEFORE_SHA}" | |
| head_sha="${PUSH_AFTER_SHA}" | |
| ;; | |
| *) | |
| base_sha="" | |
| head_sha="" | |
| ;; | |
| esac | |
| while IFS= read -r line; do | |
| echo "${line}" >> "${GITHUB_OUTPUT}" | |
| done < <(./tools/dev/classify_ci_changes.sh "${base_sha}" "${head_sha}") | |
| dependency-review: | |
| needs: changes | |
| if: github.event_name == 'pull_request' && needs.changes.outputs.run_full_ci == 'true' | |
| timeout-minutes: 10 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Dependency review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: high | |
| codeql: | |
| needs: changes | |
| if: ${{ github.event_name == 'schedule' || needs.changes.outputs.run_full_ci == 'true' }} | |
| timeout-minutes: 30 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Python scans schema/tooling scripts; Actions scans workflow risks. | |
| # Go code in this repository is limited to tiny examples. | |
| # Starlark formatting/lint checks run in CI via Buildifier. | |
| language: ["python", "actions"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Analyze with CodeQL | |
| uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 |