Permit one running instance unless the backend has distributed locking, and enforce it #646
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| # Static analysis (code scanning) for the Go sources. Results are uploaded to | |
| # the repository's Security -> Code scanning tab and satisfy the "Main" | |
| # ruleset's code_scanning rule, which otherwise blocks any PR targeting the | |
| # default branch from merging. That ruleset covers ~DEFAULT_BRANCH only, so a | |
| # PR targeting another branch is not gated by it — which is precisely why the | |
| # pull_request trigger below is unfiltered: a stacked PR was neither gated nor | |
| # scanned, and its code first met CodeQL only once it reached main, inside a | |
| # larger change where a finding is harder to attribute. | |
| # | |
| # Triggers: | |
| # * Push to main -> establish the baseline analysis on the default | |
| # branch. Left on main deliberately: a PR already gets a pull_request run. | |
| # * Pull requests -> analyse the proposed changes, whatever the base, so | |
| # the merge gate has fresh results and stacked work is scanned when it is | |
| # written rather than when it lands. | |
| # * Weekly schedule -> re-scan with updated CodeQL queries even when the | |
| # code is quiet, so newly published advisories are still caught. | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| schedule: | |
| - cron: "27 4 * * 1" | |
| # Don't pile up redundant analyses for the same branch/PR. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze (Go) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Required to upload code-scanning results. | |
| security-events: write | |
| # Needed by the CodeQL action to read the workflow run on private repos. | |
| actions: read | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| languages: go | |
| # "security-and-quality" widens coverage beyond the default security | |
| # queries; the ruleset only gates on error-level alerts. | |
| queries: security-and-quality | |
| # Filters only -- the file sets no `queries:` key of its own, so it | |
| # does not interact with the input above. It excludes go/log-injection | |
| # and explains what makes that sound; read it before adding anything. | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| - name: Perform CodeQL analysis | |
| uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| category: "/language:go" |